Who is responsible
Maximo Garcia (also known as Maxi) develops and operates Cactus and is the controller for the personal data Cactus decides to process. Contact support@usecactus.app for privacy questions or requests.
Checkout is provided as “Sold through Link.” Stripe and Link separately decide how they process payment-account, payment-method, fraud-prevention, tax, and transaction-support data under their own terms and privacy notices.
In the Mac App Store edition, Apple sells Cactus and runs the free trial. Apple separately decides how it processes your Apple Account, payment, and transaction data under its own terms and privacy policy.
What stays on your Mac
Your schedule, blocked domains, and current blocking state are stored locally. Cactus has no user account, cloud sync or advertising. It neither sends your blocked-site list to Cactus servers nor requests icons from those sites. Error reports and optional private usage counts are described below.
When the direct-download edition of Cactus opens, Sparkle requests a signed update feed from Cactus’s Cloudflare-hosted release service. Cloudflare may receive the IP address and standard request metadata. Profile reporting and automatic installation are disabled, and the request does not include your schedule or blocked domains.
The Mac App Store edition has no update feed: it gets updates only from the App Store and makes no update request of its own. It applies blocks with a macOS content filter that checks the website name of each new connection against your list on your Mac. The filter does not connect to the internet and keeps no record of the sites you visit.
Error reports
When Send Error Reports is on, which it is by default, Cactus sends a report after something fails or only partly works, such as a scheduled block that could not be applied, the background helper not responding, or a failed update check. Nothing is sent while everything works, and a failure that repeats on its own, such as a block that keeps failing to apply, is reported at most once an hour.
A report contains the name of the failed operation, an error code with a fixed description of what happened, why, and how to fix it, system error numbers, counts such as how many sites are on your list, whether a block was scheduled at that moment and which protections were in place, how long the operation took, the Cactus and macOS versions, the time, and a random identifier created on your Mac only for error reports. It never contains your blocked sites or their network addresses, your schedule, file paths, your user name, license key, email address, or purchase details; Cactus replaces system error text with codes and numbers before anything leaves your Mac.
The background helper never connects to the internet. It keeps its most recent 100 events on your Mac, and the app reads them to send error reports and to add them to Send Feedback diagnostics. Reports go to the Cactus server on Cloudflare, which forwards them, without your IP address, to PostHog in the EU. They are kept in PostHog under its retention period for our project and are not linked to purchase records or website analytics. We use them for the legitimate interest of finding and fixing problems that stop blocks from working.
You can turn Send Error Reports off during setup or from the Cactus menu at any time. Cactus then deletes reports it has not sent yet and sends nothing more; events kept on your Mac stay there and are removed when you remove Cactus.
Optional private usage counts
Share Private Usage Counts is off by default for new and existing installations. If you turn it on during setup or in the Cactus menu, the app reports successful setup, at most one app-active event per UTC day while Cactus is running, and successful license activation. Setup and activation are each reported at most once while that consent remains on. These counts describe participating installations, not people or every Cactus user.
Each event includes a separate random analytics ID, a random event ID and timestamp, app version and build, macOS major version, and fixed distribution and build-environment labels. Debug and test builds are labelled separately. The analytics ID is not the error-report ID and is not linked to purchase records or website visitors. The payload contains no blocked sites, site counts, schedules, browsing history, email, license keys or purchase identifiers. There is no session replay, autocapture, device fingerprinting, identify or alias call.
The app sends these events over HTTPS to Cloudflare, which forwards only these fields to PostHog in the EU. The forwarding request contains no raw IP address, browser headers or device headers, disables GeoIP and does not create a person profile. Cloudflare still processes the incoming network request for hosting and rate limiting. This is pseudonymous installation counting, not a promise that internet requests are anonymous.
Usage counts rely on your consent. Turning them off cancels pending transmission and deletes the local analytics ID, queued events and counting history. A request already transmitted may have arrived. Events already received remain subject to the project retention period; turning the setting off does not delete those events from PostHog. Turning it on again creates a new ID. Unsent events expire after seven days and are discarded when the app next processes its bounded queue. Retries are limited. The error-report setting is independent.
Direct-download purchases and licenses
Link and Stripe collect the details needed to process your purchase. For fulfillment, license activation and recovery, refunds, disputes, and records Cactus receives or stores the purchase email, Stripe checkout session, payment-intent and event references, payment-link reference, amount, currency, payment status, a hash of the license key, and purchase/update timestamps.
When you activate Cactus, the app sends the license key over HTTPS. The server hashes the key and checks for a paid order; it does not store the raw key. License recovery sends the purchase email and Stripe receipt number over HTTPS, verifies them with Stripe, and returns the key. The receipt number is used for that check and is not added to the Cactus purchase database. A full-refund or lost-dispute event changes the stored payment status so that future activation and recovery stop.
This processing is necessary to perform the purchase contract and provide the license. Transaction records may also be retained where necessary for accounting, tax, disputes, fraud prevention, and legal claims.
Mac App Store purchases
In the Mac App Store edition, you start the free trial and buy Cactus through the App Store. Apple processes the payment and any refund. Cactus does not receive your name, email address, Apple Account, or payment details.
The app asks macOS which Cactus purchases your Apple Account owns and records the result on your Mac. It sends nothing about your trial or purchase to Cactus servers and needs no license key. Apple gives the developer sales and financial reports, such as country, price, and proceeds, which Cactus uses for accounting and tax.
Optional feedback
If you choose Send Feedback, Cactus sends and stores your message. You may provide an email address if you want a reply; leave it blank if you do not. If you turn on diagnostics, Cactus also sends the Cactus version, macOS version, protection state, launch-at-login state, whether error reports are on, latest error, and recent events from your Mac in the same form as error reports. Blocked-site names are excluded.
Feedback, any reply email you provide, an identifier, source, and timestamp are stored in Cloudflare D1. Cloudflare sends an email notification to the developer. We use this information to respond to your request and for the legitimate interest of diagnosing problems and improving Cactus.
Support and purchase cancellation
If you email support or send a withdrawal notice, Cactus receives the sender address and message, plus any name, checkout email, receipt or order identifier, and order or access dates you choose to include. We use this information to answer the request, identify the purchase, perform the purchase contract, and meet consumer-law, refund, dispute, and legal obligations.
Ordinary support correspondence is deleted when the request is resolved and the record is no longer needed. Withdrawal, refund, and dispute correspondence may be kept with the related purchase record while needed for accounting, consumer-law, dispute, and legal-claim obligations.
Website and service providers
Cloudflare hosts the website, APIs, database, downloads, rate limiting, logs, and traces. It may process request information such as IP address, request metadata, and security signals. Cactus does not add advertising trackers to the website.
To learn which pages, guides, and links bring people to Cactus, the website uses PostHog analytics in cookieless mode, hosted in the EU. It records page views, the referring site and campaign tags in the link, approximate country, browser and device type, page-load performance, clicks on the download and buy links, trial downloads, and completed purchases with their amount but no name, email, or payment details. It sets no cookies and stores nothing on your device. PostHog counts unique visitors with a hash of your IP address, browser, and a salt that changes daily; it does not keep the IP address. This is based on our legitimate interest in understanding and improving the website.
- Apple — Mac App Store distribution, the free trial, purchases, refunds, updates, and sales reports for the App Store edition.
- Stripe and Link — checkout, payment, tax, fraud, receipts, order management, and transaction support.
- Cloudflare — website, API, database, feedback notification, downloads, update delivery, security, and operational infrastructure.
- PostHog — cookieless website analytics, app error reports and optional usage counts, hosted in the EU.
These providers may process data outside the EEA. Their applicable terms, data-processing agreements, and transfer safeguards govern that processing.
How long information is kept
Purchase records and license hashes are kept while needed to provide the purchased license and meet accounting, tax, refund, dispute, fraud-prevention, and legal-claim obligations. Private daily backups of purchase records are automatically deleted after 365 days. Feedback notification emails are deleted when the support or product review is complete and no later than 180 days after submission. A daily cleanup removes every feedback record from the active database within 180 days; Cloudflare recovery copies and technical logs expire under the provider’s retention periods. Website analytics events, app error reports and optional app usage events are kept in PostHog under its retention period for our project. App usage events use their own random identity and are not linked to error reports, purchases or website visitors.
Your rights
Depending on the law that applies, you may ask for access, correction, deletion, restriction, or a portable copy of your personal data, and you may object to processing based on legitimate interests. You can withdraw consent for optional usage counts at any time by turning them off in the Cactus menu. Some information may need to be retained for a purchase, legal obligation, or legal claim.
Send requests to support@usecactus.app. If you are in Sweden or the EEA, you may also complain to the Swedish Authority for Privacy Protection (IMY) or your local supervisory authority. For data controlled directly by Stripe or Link, use Stripe’s privacy request portal. For App Store purchases and your Apple Account, use Apple’s Data and Privacy page.
Children and changes
Cactus is not directed at children and does not knowingly seek personal data from them. We may update this policy when the product, providers, or law changes; the current version and update date will remain on this page.