Privacy Policy

Last updated: November 4, 2026

SpatialTap is built to leave no trace. This page lists everything the app and this website do with data, which is very little.

SpatialTap is a product of PE Babiy Yuliia, Ukraine (“we”), who is responsible for the data described here. Write to support@spatialtap.com about anything on this page.

The app

SpatialTap does not collect analytics, telemetry, crash reports or usage data. It has no account system and never uploads audio.

• Audio. SpatialTap asks macOS for “System Audio Recording Only” access. This permission lets it receive the sound of other apps so macOS can spatialize it. The audio is processed in memory and played to your headphones immediately. It is never written to disk or transmitted.
• License check. The app talks to SpatialTap’s own license server at license.spatialtap.com, and only for a license key. Activating a key sends the key, your Mac’s computer name and a hashed hardware identifier: a one-way SHA-256 hash of the Mac’s hardware UUID behind a SpatialTap-specific prefix, which tells your Macs apart without revealing the UUID and means nothing outside SpatialTap. If the hardware UUID can’t be read, the computer name takes its place. Re-checking and deactivating send the key and the instance ID the server gave this Mac when it was activated. Like any internet request, these also carry your IP address and the standard request headers macOS adds (the app’s name and version, the system’s network library version and your preferred languages). A licensed app re-checks its key at most once a week; if the activation stored on your Mac can’t be verified, the app activates again instead. Being offline never removes a license. The trial contacts no server.
• Updates. Once a day the app checks spatialtap.com/appcast.xml for new versions using the Sparkle framework. That request includes the app version and macOS version so the right update can be offered. No profile is stored; SpatialTap’s Sparkle system-profile reporting is turned off. An update is downloaded from GitHub (github.com), which sees your IP address like any download host.
• Local storage. The on/off state is kept in user defaults, next to Sparkle’s own update-check settings, and Launch at login is a macOS login item. The trial start date and your license are kept in the login keychain: the key, this Mac’s instance ID, the email address the license server returns for the key (the menu shows it as the licensee), the license status, the date of the last check and the server’s signed activation. SpatialTap’s own log lines (app names, the output device and timings, no audio) go to the macOS system log, which stays on your Mac. Nothing else is stored, apart from the problem reports you make yourself.
• Problem reports. Only when you choose Report a Problem… in the menu, SpatialTap puts together a report: the app, macOS and Mac model versions and the time with its time zone; what the menu shows (the switch, the license state without its email address or key, any notice, the output device and its settings, the permission, the spatial mode, and the apps it handles — their names, bundle IDs, process IDs and whether they are playing); and SpatialTap’s own log lines since it was launched, which name apps and timings and contain no audio. The output device’s name is the one macOS shows, which often includes your first name (“Anna’s AirPods”). The report opens as a draft email to support in your mail app (or is copied to the clipboard if no mail app opens), and the full copy is saved on your Mac in ~/Library/Logs/SpatialTap for you to attach. Nothing is sent unless you send that email yourself, and the saved file stays on your Mac until you delete it. A report you send is used only to look into the problem.

Purchases

Payments are handled by Paddle, the merchant of record. Paddle receives your payment details, billing address and email, sends your receipt and handles tax and refunds, as described in Paddle’s privacy policy. SpatialTap never sees your card.

After a purchase, Paddle tells SpatialTap’s license server about it, and the server asks Paddle for the email address of the buyer. The server keeps:

• your license key, your email address and Paddle’s transaction ID for the purchase, with when the key was created, emailed and, if it was, refunded;
• for each Mac the key is activated on, its slot: a random instance ID, the hashed hardware identifier, the computer name and when it was first activated. Deactivating a Mac deletes its slot;
• whether the purchase was refunded or charged back, and when someone last asked for the keys of an email address to be sent again (to limit how often that can happen).

These records are kept for as long as the license exists. Paddle keeps its own records of the purchase under its policy.

The license server runs on Cloudflare. Your key is emailed to you through Resend, which receives your email address, the key and Paddle’s transaction ID (so the same email is never sent twice) for that purpose only. When something fails, the server’s error messages can include a Paddle transaction or customer ID; they are not stored. Your email is used for the key, the receipt and support, not for marketing.

This website

spatialtap.com is a static site with no cookies. Cloudflare, which hosts it, counts visits with Cloudflare Web Analytics: a script from static.cloudflareinsights.com reports which page you opened (without its query), the page you came from, your browser, system and device type, your country, and how fast the page loaded. It sets no cookie, and we use the counts only to see how the site is used and how fast it is (legitimate interests). Paddle’s checkout (cdn.paddle.com) loads when you click Buy, when you open the buy link (spatialtap.com/#buy, which the app’s Buy button opens) or a Paddle payment link; it is covered by Paddle’s privacy policy. Apart from these two, no third-party script runs. The page after a purchase and the “Find my license key” page talk only to SpatialTap’s license server; the page after a purchase keeps Paddle’s transaction ID in your browser’s session storage until you close the tab, so a reload still finds your key. The download button links to GitHub. The hosting provider may keep standard server logs (IP address, requested page, time) for security purposes. If you email us to be told when SpatialTap is out, we use your address only for that one email, which you asked for, and then delete it. The site doesn’t track individual visitors, so a Do Not Track signal changes nothing.

Legal basis and transfers

We use your purchase and license data to provide the license you bought (performance of a contract), and server logs and the resend limit to keep the service secure (legitimate interests). An email you send us, including a problem report, is used only to answer it (legitimate interests) and kept only as long as that takes. Cloudflare, Resend, Paddle, GitHub and our email provider may process this data outside your country, including in the United States, under their own safeguards such as the EU Standard Contractual Clauses; write to us for a copy.

Your rights

You can ask for a copy of your records (also in a machine-readable form), a correction, their deletion or a restriction of their use. You can object to any use based on legitimate interests. To have your records on the license server deleted, write to support@spatialtap.com from the address you bought with (or include your order number). Within 30 days we erase your email address, your Macs’ slots, any resend requests and the record of refunds. The license key and Paddle’s transaction ID are kept, marked as ended, so the key stops working and the purchase is not issued a new one. Deleting your records ends your license key.

A license key ends with a full refund, with a chargeback (unless the chargeback is reversed), or when you ask us to delete your records. A partial refund does not end it. SpatialTap then stops at its next check of the key (at most once a week, and only when it can reach the license server), and your apps sound the way they did before.

For anything else about this policy, write to the same address. You can also complain to your data protection authority.

Changes

If this policy changes, the new version is posted here with an updated date.