Privacy notice

Last updated: [EFFECTIVE DATE]

In short: AMWT works on your Mac. We never collect the names or contents of your files, and there are no analytics. The app connects to the internet only to open the payment, collect your receipt, check for updates, and, if you choose, to sign in to an account or contact support. Paddle handles your payment details; we never see your card. If you choose Restore with AI, the photos you pick are sent through our server to OpenRouter and the AI model provider to be restored, and none of us keeps them. You can download or delete your account data yourself from your account page.

1. Who is responsible

Bonny James, trading as AMWT, [POSTAL ADDRESS], is the controller for the personal data described here. Contact: [CONTACT EMAIL]. ICO registration number: [ICO REGISTRATION NUMBER, if registration is required].

2. What we never collect

Scanning, previewing and recovery all happen on your Mac. We do not collect, upload or see file names, folder names, file contents, thumbnails, scan results or the list of drives on your computer. The app contains no analytics or tracking, and neither does the website. The one exception to this section is Restore with AI, described in section 3: only the photos you choose for it are sent, and only so they can be restored.

3. What we collect, and why

Install ID

When you first use the app it creates a random install ID. It is not derived from your name, your Mac's serial number or any account. It is sent to Paddle with your payment and used to collect your receipt, so that the receipt reaches the right copy of the app.

Receipts

When a payment completes, Paddle tells our receipt server, which creates a signed receipt. Each receipt record holds the Paddle order ID, the install ID, the drive's volume serial number (a number the drive's file system assigns when it is formatted) and the dates it was issued and expires. The app downloads the receipt and checks it offline from then on.

Payment and order details

Paddle.com is the merchant of record and processes your payment as an independent controller. Paddle collects your name, email address, country, billing details and payment method. We never receive your card details. Paddle shares order details with us, such as your email address, Paddle customer ID, country, order ID, amount and currency, so we can link the purchase to your account if you have one, support you and handle refunds. We keep a purchase record with the order ID, amount, currency, date, status, the drive's volume serial number and the drive's name if the app sent it. See Paddle's privacy notice.

Your account (optional)

You never need an account. If you create one, we hold:

• your email address, and your name if you give it;
• when you joined, and your sign-in sessions (device and browser type, IP address and approximate location from it, so you can see and sign out other devices);
• short-lived sign-in and email-change codes, stored only as hashes;
• the purchases linked to your account. Purchases made with the same email address are linked automatically, including ones made before the account existed.

Invoices are fetched from Paddle when you ask for one; we do not store them. Restoring receipts sends your Mac the signed receipts for your purchases that are still in their 7-day window.

If you choose Sign in with Apple or Sign in with Google, that company tells us your email address and, if you allow it, your name. Apple may give us a private relay address instead of your real one. Their own privacy notices apply to what they do.

Restore with AI and credits (optional)

Restore with AI is an optional Enhance step that repairs photos with an AI model. When you use it, the app sends each photo you choose, reduced to 2,048 pixels on its long side, with your install ID (and your account, if you are signed in) over an encrypted connection to our server on Cloudflare. Our server takes one credit and passes the photo to OpenRouter, which sends it to the AI model provider in use and returns the restored image. Our server passes the result straight back to the app.

• We do not store the photos or the results. They are held in memory only while the restore runs.
• We only use providers that have agreed to zero data retention: OpenRouter and the model provider do not keep the photo after returning the result, and do not use it to train their models.
• File names, folder names, scan results and photos you did not choose are not sent.
• Photos can contain personal data, such as people's faces. Only send photos you have the right to share for this purpose.

To keep your balance we hold a credit record: the install ID, your account if you have one, each change to the balance (purchase, free credits, use, refund) with the date, and the Paddle order ID for purchases. To stop abuse we count restore requests per install and per IP address for a short time.

Support tickets and email

When you open a ticket on the website or in the app, or email our support address, we keep your name, email address, subject, category, your messages and our replies, and, if you add them, your order ID, your Mac model and macOS version, and the app version. A ticket opened without an account gets a private link, whose key we store only as a hash. Tickets contain whatever you write, so please do not include more personal data than you need to, and never send us your files; we do not need them.

Email to our support address passes through Cloudflare Email Routing to our ticket system. Our replies and notifications are sent through Resend. New tickets and replies also arrive in our support inbox.

To stop abuse we count new tickets per email address and per IP address for up to 24 hours.

Live chat

Live chat is provided by Crisp. It does not load until you click "Chat with us". After that, Crisp receives your messages, anything you type such as your email address, and technical details such as your IP address, browser and the page you are on, and it sets its own cookies. See the cookie notice and Crisp's privacy policy.

Update checks

The app checks for updates by downloading a signed update manifest from our website (hosted by Cloudflare). The request includes your IP address, as any internet request does, and may include the app version and whether your Mac uses Apple silicon or Intel. It contains no install ID, account or file information.

The website

This website is hosted by Cloudflare. Cloudflare processes your IP address and request details to deliver the pages and protect them from attack. The website sets no cookies of its own unless you sign in: then it sets one cookie, drp_session, to keep you signed in; the payment page loads Paddle's checkout; and chat loads Crisp only when you ask for it. The cookie notice lists each item.

4. Legal bases

We do not make decisions about you by automated means that have legal or similarly significant effects. We do not sell personal data or use it for advertising.

5. How long we keep it

6. Who processes it for us

These companies process personal data on our behalf, under contracts that require them to protect it. The sub-processors page has the full list with links.

Paddle, Apple and Google act as independent controllers for the data they handle, under their own privacy notices. We may also share data where the law requires it, or with professional advisers such as our accountant.

7. International transfers

Some of these providers are based in, or may access data from, countries outside the UK, including the United States. Where personal data leaves the UK, we rely on safeguards recognised under UK data protection law: UK adequacy regulations (including the UK–US data bridge for certified companies), or the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. You can ask us for details.

8. Your rights

Under UK data protection law you can ask us for a copy of your personal data, ask us to correct or delete it, object to or restrict how we use it, and ask for it in a portable form.

• Do it yourself: on your account page you can change your name and email, download everything we hold about you as a JSON file, sign out other devices, and delete your account. Deleting it removes your login, tickets and messages straight away. Purchase records stay for the period in section 5, unlinked from you and without your email address. Credits on your account are lost when you delete it.
• Ask us: through the support page or at [CONTACT EMAIL]. If you have no account, it helps to give your Paddle order ID or ticket reference. We reply within one month.
• Payment data: for data Paddle holds, contact Paddle as well.

If you are unhappy with how we handle your data, please tell us first. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

9. Security

Data is sent over encrypted connections. Our databases have no direct client access; every request goes through server code that checks who is asking. Sign-in codes and private ticket links are stored only as hashes. Receipts are signed so they cannot be forged.

10. Children

Our services are not aimed at children. Accounts are for people aged 13 or over.

11. Changes

If we change what we collect, we will update this notice and its date before the change takes effect, and email account holders about significant changes.