SomethingGet the first build

Privacy Policy for Something

Version 1.1 · Last updated 31 October 2026 ·

This policy explains what personal data BAARS DESIGN processes when you use Something, its website and our support channels, and what your rights are.

The short version: Something runs on your Mac. Your project files, code, prompts and AI responses stay there or go straight to services you chose. What reaches us is your account, your plan, your team membership, and the messages you send us.

1. Who is responsible

The controller is:

We have no data protection officer; the law does not require one for a business of this size and kind. Write to the address above about anything to do with your data.

2. What this policy covers

  • The Something desktop app for macOS.
  • The Something website at changesomething.app (and its earlier address, apps.baars.design/something), its contact form and its waitlist.
  • Accounts, teams and billing.
  • Email you send us and email we send you.

It does not cover services you connect to through the app under your own account: GitHub, your AI provider, and Google or Apple as sign-in providers. Each has its own privacy policy, linked in section 8.

3. What stays on your Mac

This section is about data we do not receive. It comes first because it is the most important fact about how Something handles data.

Your projects. Project files, code, branches, commits, screenshots, canvases, history, undo state and the index the app builds of your project are stored on your Mac, in the project folder and in ~/.something. The app never uploads them to BAARS DESIGN.

Your AI conversations. When you use an AI feature, the app sends your prompt and the relevant code from your Mac directly to the AI provider you set up (Anthropic, OpenAI or Google, through their CLI tools or API). Nothing passes through our servers and we cannot see it. Your conversation threads are stored on your Mac in ~/.something/threads.json.

Your credentials. Your sign-in session, your GitHub token and any AI API keys you enter are stored in the macOS keychain under the service name “Something”. They are never written to a file or sent to us. Plugins cannot read the account or GitHub entries.

Logs. The app writes a log to ~/Library/Logs/Something/main.log and keeps the previous run as main.previous.log. The log stays on your Mac. We only see it if you send it to us when asking for help.

No analytics or telemetry. The app contains no analytics, crash reporting or usage tracking code, and sends no usage events to us or anyone else. We checked the source for such code on 2026-10-30 and found none. If that ever changes, we will update this policy and tell you first.

4. What we process, and why

Each part below is one processing activity. “Basis” refers to Article 6(1) of the GDPR. Section 4.12 lists every retention period in one table.

Sign-in and payments are not switched on yet. Sections 4.1 to 4.4 apply from the day they are.

4.1 Account
Data Email address, display name, sign-in method (Google, Apple or email code), the identifier your sign-in provider gives us for you, when you signed up and last signed in, and your IP address at sign-in. If you use Apple’s “Hide My Email”, we receive a relay address instead of your real one. If you start the free trial, the GitHub login you give for it.
Purpose To create and secure your account, to know which plan and organisation you belong to, to contact you about your account, and to allow one free trial per person.
Basis Article 6(1)(b), contract: we cannot provide an account without this. For the trial record, Article 6(1)(f), our legitimate interest in preventing repeated trials.
Where Supabase Auth, hosted on AWS in Stockholm, Sweden, and our own server in Norway (section 5).
Retention As long as your account exists. When you delete your account we erase it within 30 days, except what we must keep under 4.4. Sign-in IP addresses and times: 90 days. We keep the record that a trial was used (an account id and the GitHub login) after deletion, so the trial cannot be repeated.

4.2 Organisations and teams
Data Organisation name, your role (owner, admin, billing, editor), whether you hold a seat, who invited you and when, invite emails sent by an admin, and an audit log of administrative actions (who changed what and when).
Purpose To run team plans: seats, invites, access control, and the audit trail business customers need.
Basis Article 6(1)(b) for members who are the customer; Article 6(1)(f), legitimate interest, for processing for an organisation customer. Where an organisation is the controller for its members’ data, we act as its processor under the Data Processing Agreement.
Retention While the organisation exists and you are a member. An invite expires after 7 days and is deleted once it has expired or been withdrawn. Audit log entries: 2 years. If a person deletes their account, their entries keep only a pseudonymous id.

4.3 Plan, entitlement and devices
Data Your plan, seat, subscription status, trial status, and a signed entitlement token the app keeps in your keychain. The app reports its version and your Mac’s name and platform so you can see where you are signed in.
Purpose To unlock the features of your plan, including offline, and to show you your devices.
Basis Article 6(1)(b), contract.
Retention Device records: 12 months after the device was last seen. We record no usage counts today. If we start counting usage per seat (for example, the number of pull requests sent per month, never their content), we will keep those counts for 24 months and update this policy first.

4.4 Billing

BAARS DESIGN is the seller. Stripe processes payments.
Data Billing name and address, email, VAT number if you give one, the plan and seats you bought, invoices and receipts, payment status. You enter your card number on Stripe’s pages and we never receive it; we see the last four digits and the card brand.
Purpose To take payment, issue invoices, calculate tax, handle refunds and failed payments, and meet our tax and bookkeeping duties.
Basis Article 6(1)(b), contract, for taking payment; Article 6(1)(c), legal obligation, for invoices, tax records and bookkeeping.
Retention Accounting records, including invoices, are kept for five years after the end of the accounting year, as bokføringsloven § 13 requires. We cannot delete them earlier, even if you ask.

Stripe also processes your payment data as an independent controller for fraud prevention and legal compliance, under its own privacy policy (linked in the Subprocessor list).

4.5 Support and email you send us
Data Your email address, name, what you write, and any attachments or logs you choose to send.
Purpose To answer you.
Basis Article 6(1)(b) if you are a customer; otherwise Article 6(1)(f), our legitimate interest in answering enquiries.
Where Our own mail server, mail.baars.design, on a virtual server at Oracle Cloud in Amsterdam, Netherlands.
Retention 24 months after the last message in the conversation, then deleted.

4.6 Contact form and waitlist on the website
Data Contact form: name, email, company (optional), topic, your message, and when you sent it. Waitlist: your email address, the plan you looked at, and the page you were on. For abuse prevention our server uses your IP address to limit how many messages one address can send; it keeps only a shortened hash of it, with contact messages.
Purpose To answer you, and to send you one email when the first build of Something is out.
Basis Contact form: Article 6(1)(f), our legitimate interest in answering enquiries, and 6(1)(b) if the enquiry leads to a contract. Waitlist: Article 6(1)(a), your consent, which you give by joining and can withdraw at any time.
Where Our own server in Norway. The form reaches it through our server at Oracle Cloud in Amsterdam, which passes it on over an encrypted connection (section 5). New contact messages are also emailed to us (see 4.5).
Retention Contact messages: 12 months from when you sent them. The IP hash: 30 days. Waitlist: until we have sent the release email, and never more than 12 months after you joined. Every waitlist email has a link that removes you at once, and you can also ask us by email.

4.7 Email we send you
Data Your email address and the content of the message: sign-in codes, invites, receipts, renewal reminders, failed-payment notices, security notices, changes to terms.
Purpose To run the Service. These messages are not marketing, and while you have an account you cannot opt out of them.
Basis Article 6(1)(b), contract.
Where Sent through our mail server (Oracle Cloud, see 4.5). Stripe sends receipts and invoices itself.
Retention Sending logs: 90 days.

4.8 Marketing email

We send no marketing email. If that changes, we will send it only with your prior consent, or to existing customers about our own similar products where Norwegian law allows it (markedsføringsloven § 15). Every marketing email will have an unsubscribe link.

4.9 Automatic update checks
Data An installed copy of the app looks for updates about 30 seconds after it starts and every four hours after that, as long as it runs from an Applications folder. It fetches the release feed and the update file from GitHub (github.com/the-baaron/something-releases). GitHub sees your IP address and a standard user-agent string. We receive nothing; the feed is a public, static file.
Purpose To deliver updates, including security fixes.
Basis Article 6(1)(f), our legitimate interest in keeping the app secure and current.
Retention None by us. GitHub keeps its logs under its own privacy statement.

The app has no setting to turn these checks off. If you do not want your Mac to contact GitHub for updates, block connections from Something to github.com and its download hosts with a firewall, or do not use the app. You can object to this processing by email; we will tell you how the checks work and how to block them, but we cannot stop an installed copy from checking.

4.10 GitHub integration
Data The app lists repositories you have given the Something GitHub App access to, and shows your GitHub login. Pull requests are created through your own GitHub CLI. All of this uses your GitHub token, stored in your keychain. To decide whether a paid plan is needed, the app looks up whether a repository is owned by a person or an organisation; that lookup uses your token or an anonymous request, never a BAARS DESIGN token.
What we receive Nothing about your repositories.
Basis Article 6(1)(b), contract: you asked the app to work with your repositories.

4.11 Website visits

The Something website uses no analytics and loads no third-party scripts or fonts. It sets no cookies. At changesomething.app it is served by our own server at Oracle Cloud in Amsterdam, which keeps standard web server access logs, including IP addresses, for security and operation.

The same pages are also shown at their earlier address, apps.baars.design/something, inside the apps.baars.design page, which does three more things:

  • it loads app icons from img.baars.design, our image storage at Cloudflare;
  • it loads a style sheet from Mapbox (api.mapbox.com), so Mapbox sees your IP address and browser details when you open the page (Mapbox privacy policy);
  • it sets one cookie, lang, only if you pick a language with its language switch. The cookie holds that choice and nothing else, for a year.

Vercel, which hosts apps.baars.design, logs requests, including IP addresses, for security and operation, under its own terms. If any of this changes, we will update this policy first.

4.12 Retention at a glance

Data Kept for
Account (after you delete it) Erased within 30 days
Sign-in IP addresses and times 90 days
Invites not accepted 7 days, then deleted
Organisation audit log 2 years
Device records 12 months after last seen
Usage counts (none recorded today) 24 months
Support email 24 months after the last message
Contact-form messages 12 months
IP hash on contact messages 30 days
Waitlist Until the release email, at most 12 months
Email sending logs 90 days
Database backups 30 days
Invoices and accounting records 5 years after the end of the accounting year (bokføringsloven § 13)

5. Who receives your data

We share personal data only with the service providers we need to run Something. The Subprocessor list gives each one’s role, location and transfer mechanism. In summary:

Provider What for Location
BAARS DESIGN’s own server The billing and account service: accounts, teams, plans, devices, contact messages, the waitlist, backups Norway
Cloudflare Runs DNS for baars.design and stores the images of the apps.baars.design page Cloudflare, Inc. (US); global network
Vercel Hosts the earlier website address, apps.baars.design Vercel Inc. (US); global network
Mapbox Receives your IP address when the apps.baars.design page loads its style sheet (section 4.11) Mapbox, Inc. (US)
Oracle Cloud Hosts our mail server, which also serves the website at changesomething.app and passes all traffic between the internet and our server on to it (including the contact form and the app’s sign-in and plan checks) Amsterdam, Netherlands; Oracle is a US company
GitHub Hosts the update feed; sees your IP on update checks United States
Supabase (when sign-in is switched on) Account sign-in and user records AWS Stockholm, Sweden; Supabase Pte. Ltd is in Singapore
Stripe (when payments are switched on) Payments, invoices, tax Stripe Payments Europe, Limited (Ireland), with Stripe, LLC (US)
Google, Apple Sign-in providers, if you choose them Google LLC (US); Apple Distribution International Limited (Ireland)

We do not sell personal data, and we do not share it with advertisers.

We disclose data to authorities only when the law requires it, and we tell you unless the law forbids it.

If BAARS DESIGN is transferred to another company, your data moves with the business, and this policy keeps applying until it is changed with notice.

6. Transfers outside the EEA

Norway is in the EEA, so the GDPR applies in full. Some providers process data in the United States or Singapore. For each we rely on one of these:

  • The EU-U.S. Data Privacy Framework (DPF), for a US provider that is certified under it. Stripe, LLC, GitHub, Inc., Google LLC and Cloudflare, Inc. each state that they are.
  • Standard Contractual Clauses (SCCs) under Commission Decision (EU) 2021/914, included in the provider’s data processing agreement. Used by Vercel, Cloudflare (if its DPF certification lapses), Stripe, GitHub, Supabase, Apple and Oracle.

These are each provider’s own statements, read on 2026-10-30. You can ask us for a copy of the clauses that apply.

7. Your rights

Under the GDPR you can:

  • access the data we hold about you, and get a copy;
  • correct data that is wrong;
  • delete your data. We keep what the law requires (invoices, section 4.4), the trial record (section 4.1) and a pseudonymous id in team audit logs;
  • restrict processing, or object to processing based on legitimate interest;
  • export your data in a machine-readable format (JSON);
  • withdraw consent where we rely on it, with effect from then on.

Email privacy@changesomething.app. We answer within one month, as the GDPR requires, and may ask you to confirm your identity first. There is no charge unless requests are clearly excessive.

Complaints. You can complain to the Norwegian Data Protection Authority:

If you live in another EEA country, you can complain to the authority there instead.

8. Third parties you connect to yourself

These services receive data from your Mac because you chose to use them. We are not the controller for that processing.

When you sign in with Apple, Apple gives us a unique identifier, your name as you choose to share it, and either your email address or a relay address if you hide it. When you sign in with Google, Google gives us your email, name and profile picture (the openid, email and profile scopes).

9. Security

  • Your credentials live in the macOS keychain, never in files. Values are passed to the keychain without appearing on a command line.
  • All connections from the app to our server and to third parties use TLS.
  • Sign-in uses the system browser with PKCE and a loopback redirect, as RFC 8252 recommends. The app holds no client secret.
  • The app’s window never sees a token; the background process only answers “who is signed in”.
  • Plugins cannot read the account or GitHub keychain entries.
  • Our server checks the signature of every sign-in token, verifies Stripe’s webhook signatures, limits request rates, and writes logs that never contain tokens and hold email addresses only as hashes.
  • The database is backed up nightly. Backups are kept for 30 days and are readable only by the server’s own account.
  • Releases are signed with an Apple Developer ID and notarized. Updates are checked against a SHA-512 hash and the signature before installation.

If we learn of a breach that is likely to put your rights at risk, we notify Datatilsynet within 72 hours and tell you without undue delay, as Articles 33 and 34 of the GDPR require.

10. Cookies

The website uses no analytics and no tracking cookies. The only cookie is lang, set when you pick a language with the language switch on apps.baars.design (the website’s earlier address), to remember that choice (section 4.11). The app is not a website and sets no cookies. If we ever add cookies that need consent, we will ask first and update this section.

11. Children

Something is for professional use. You must be 18 to buy a plan and 13 to use the Free plan with an account; 13 is the age at which Norwegian law lets a person consent to an online service themselves (personopplysningsloven § 5). We do not knowingly collect data from anyone under 13. If you think a child has given us data, email us and we will delete it.

12. Automated decisions

We make no decisions about you by automated means that have legal or similarly significant effects. The app’s plan checks (for example, whether a repository belongs to an organisation) decide which features are available, not anything about you as a person.

13. Changes to this policy

We post changes here with a new date and version. For material changes we email account holders and show a notice in the app at least 30 days before they take effect. Earlier versions are available on request.

14. Contact