This policy covers the MidClick app and midclick.app. MidClick is available by direct download, with purchases through Lemon Squeezy and activation through its first-party licensing service.
Who is responsible
Mihail Plamenov Duchev, an individual developer based in Bulgaria, develops MidClick and is responsible for the personal information handled for this website and support. For privacy questions or requests, email support@midclick.app.
Mihail Plamenov Duchev is an individual developer, not registered as a company or sole trader and not VAT-registered. Contact address supplied by the developer: Sofia, 1336 Sofia, Bulgaria. Email support@midclick.app.
Gesture processing stays on your Mac
MidClick processes mouse and trackpad contacts on your Mac to recognize the gestures you enable. It uses Accessibility permission to deliver the resulting mouse and gesture actions. It does not upload these contacts, record your screen, read your clipboard, or log typed keys. There is no advertising or analytics SDK in the app.
Your gesture preferences, tuning values, selected app lists, and other settings are saved locally. These settings are not uploaded or synchronized by MidClick.
Local trial and license records
The current trial counts days on which you use a gesture. Its use-day counter and last-use date are stored in local preferences and a local Application Support file. Idle days do not count. The current app does not upload this trial counter to a server.
On your Mac, MidClick derives a stable, app-specific pseudonymous device fingerprint from the Mac's hardware UUID. The raw hardware UUID is used only for that local calculation; MidClick does not store, log or transmit it. The resulting fingerprint is device information, not anonymous data. It can be included in a machine-bound license receipt and sent as described below during licensing requests.
Activation, receipt renewal and deactivation send your license key over HTTPS to that service. Each request also includes the MidClick app identifier, the app-specific device fingerprint and a new operation identifier. Renewal and deactivation additionally include the existing activation identifier. These fields let the service identify the product and Mac, validate the license, and manage that Mac's activation. The service and its hosting provider can receive ordinary connection information, including your IP address.
License requests do not include your raw hardware UUID, email address, gesture contacts, typed keys, clipboard contents, selected app lists or local trial counter.
License keys and activation metadata are kept in the macOS Keychain. That metadata includes license and activation identifiers, a digest associated with the key, and state used to prevent reuse of a released activation. The signed receipt is stored in Application Support and contains its device fingerprint, entitlement and activation identifiers, and validity dates. An imported receipt is checked locally and must match this Mac. Deactivation requests remote release first; confirmed success clears the active local license and retains limited retirement information to reject an old receipt. A failed request preserves recovery information.
Activation, renewal and deactivation use the first-party licensing service. The trial remains local; there is no server-backed trial.
Website and software updates
Cloudflare hosts this static website. Requests may include an IP address, browser or app information, the requested URL, and request time so that Cloudflare can deliver content and protect the service. The website has no publisher-added analytics, advertising pixels, contact forms, mailing-list forms, tracking cookies, or remotely loaded fonts. See the Cloudflare Privacy Policy for its processing, retention and international-transfer information.
MidClick uses Sparkle to check its update feed and download an update when selected. These requests expose ordinary connection and app-version information to the delivery service; they do not include your gesture contacts or selected app lists. Sparkle system profiling is not enabled by the current app configuration. You can turn off automatic update checks in MidClick settings and choose when to check manually.
Support and optional crash reports
When you email support, your email address, message, and any attachments you choose to send are processed to answer your request. The published contact uses Apple iCloud Mail; delivery also involves your email provider. Please send only the information needed for help, and do not send payment-card details or post your full license key publicly.
The app can save crash information locally, including exception details and a call stack. After a crash it offers to place a report in an email draft, delete it, or leave it for later. MidClick does not send the report automatically. Review the draft and its recipient before sending; you can use the contact address above. You can also delete local crash reports without contacting support.
Purposes and retention
Local app records support the settings, trial and license functions described above. They remain on your Mac until removed or replaced; deleting the app alone may leave its preferences, Application Support files and Keychain records. Contact support if you need help removing those records.
Support correspondence is kept for as long as needed to resolve and follow up your request, or longer when necessary to meet a legal obligation or address a dispute. Provider connection records are subject to the service's applicable retention and security practices. A fixed Cloudflare or email-provider log retention period is not promised by this policy.
Where European data-protection law applies, website delivery and security, and responding to support messages, rely on the legitimate interests of operating a secure website and helping people who contact the developer. Handling a legally required privacy request relies on the relevant legal obligation. You may object to processing based on legitimate interests.
Service providers, transfers and purchases
Cloudflare and the email providers involved in a support message may process information outside your country. Their applicable privacy notices explain their processing and transfer safeguards. Apple's information is available in the Apple Privacy Policy. MidClick does not sell your personal information or share it for targeted advertising.
Lemon Squeezy (Sold through Link, LLC, formerly Lemon Squeezy LLC) handles checkout as merchant of record, including payment, sales tax, order receipts and refunds. Test purchases and recovery checks use an isolated test environment. See its privacy notice. Merchant processing and MidClick's own licensing/support processing have different responsibilities.
The first-party licensing service is operated by the developer on Cloudflare Workers and SQLite-backed Durable Objects. It submits a license key to Lemon Squeezy and consult license, order, product and activation-instance records to check the purchase, refund status and three-Mac limit. Provider instance names use generated identifiers rather than your Mac's name. The bridge stores pseudonymous device/activation mappings, entitlement status, operation identifiers and recovery audit records; license keys are not stored in its ledger. Rate limiting uses keyed digests of IP addresses and license keys, with a one-minute sliding window and cleanup. Worker request-body logging is disabled.
License fulfillment, activation and requested transfers rely on performance of the license contract. Fraud prevention, protecting the three-Mac limit and recovery auditing rely on legitimate interests in operating a secure licensing service. Support needed to fulfill a purchase relies on the contract; other voluntary support uses the legitimate interests described above. Records required by law, including applicable accounting and privacy-request records, rely on the relevant legal obligation.
Active entitlement and device mappings remain while needed to operate and recover the license. Revocation and recovery case records remain as needed to prevent invalid reuse, resolve disputes and meet legal obligations; there is no automatic expiry for that audit history. Completed operation records and deactivated-device tombstones become eligible for pruning after 31 days and are removed during later processing, so inactive ledgers can retain them longer. Cloudflare point-in-time recovery covers the preceding 30 days; separately retained encrypted recovery archives can last longer while needed for recovery. Support and legally required transaction records follow the purpose-based retention criteria above. Contact support for a deletion request; entitlement records cannot always be removed while continuing the license service.
Cloudflare hosts the site and licensing data; Lemon Squeezy handles merchant and license-authority records; Apple iCloud Mail handles the support mailbox and iCloud Drive holds encrypted recovery backups. These services may process data outside the EEA; no EU-only hosting is promised. Cloudflare's data-processing addendum describes applicable transfer safeguards, including standard contractual clauses where required. Lemon Squeezy's data-processing addendum applies to the customer data it processes on the developer's behalf; its merchant responsibilities are also described in its own notice. Apple's privacy policy describes its international transfers and safeguards. Provider contractual and mandatory retention obligations can differ from the developer's records.
Your choices and rights
You can change gesture settings, disable automatic update checks, revoke Accessibility permission in macOS, remove local records, and choose whether to send a support message or crash report.
Depending on the law that applies, you may request access, correction, deletion, restriction, or portability of your personal information, and object to certain processing. Email the contact above to make a request. MidClick cannot retrieve local gesture information that has never been uploaded. You may also complain to your local data-protection authority, including Bulgaria's Commission for Personal Data Protection (CPDP); its official page explains how to lodge a complaint. We normally respond to a data-rights request within one calendar month. Where a lawful extension applies, we explain it within that month. Mandatory retention and the rights of other people may limit a request.
Changes to this policy
Updated practices will be described here with a revised date. Material new data processing will be explained before it is introduced, with any required notice or choice.
Licensing service diagnostics
The licensing service samples diagnostic events containing operation name, environment, status and duration. Its hosting platform also attaches request method and path, timestamp, service/version and request correlation identifiers. Application logs do not contain license keys, request bodies, query strings or client IP addresses. Invocation logs and distributed traces are disabled. These sampled Worker logs currently retain three days on the configured Free plan; other provider connection/security records follow the provider’s policies.