Privacy Policy

Sundown (“Sundown”, “we”, “us”) is a display utility for macOS, sold at trysundown.com. For the purposes of the EU and UK General Data Protection Regulation (GDPR), the operator of trysundown.com is the data controller for the personal data described in this policy. You can reach us about anything in this policy at hello@trysundown.com.

Sundown is local-first. Adjusting your display’s warmth and brightness happens entirely on your Mac; none of it requires a network connection, and your preferences are stored on your machine. The app makes a small, fixed set of network requests:

• License activation and validation. Your license key, a machine identifier, and the app version. The machine identifier is the hardware UUID macOS assigns to your computer (with the hardware serial number as a fallback). Your license is bound to this identifier on first activation — see the Terms for how that works.
• Free trial registration. The machine identifier, app version, and (if you arrived through a referral) a referral code, so we can grant one free trial per machine. Your IP address is used at request time for rate limiting and abuse prevention.
• License restore. The machine identifier, used to look up a purchase already associated with your machine.
• Update checks. The app checks trysundown.com for new versions using the Sparkle update framework. Like any web request, this reveals your IP address to our server.
• Feedback you choose to send. Your message (up to 1,000 characters), the machine identifier, the app version, and — only if you provide it — an email address so we can reply.
• Referral rewards. If you use the referral feature, your license key and the name you choose to display.
• Testimonials. A read-only download of testimonial content shown in the app. Nothing about you is sent beyond the request itself.

The app contains no analytics SDK, no advertising SDK, and no crash-reporting service. It never reads or transmits the contents of your screen.

• Your email address, used to deliver your license key, send your receipt, and handle your support requests.
• Payment, handled by Stripe. Card details are collected by Stripe, Inc. directly inside the secure checkout form. Your card number never touches our servers and we never store it. We receive tokenized identifiers from Stripe (such as customer, subscription, and payment IDs) plus purchase metadata: the plan you chose, the amount paid, and any promo, referral, or affiliate code you used.
• Your license key and activation record, including the machine identifier your license is bound to.
• Checkout follow-ups. If you enter your email at checkout but don’t complete the purchase, we may send a short follow-up about finishing it. Every such email contains an unsubscribe link, honored immediately.
• Newsletter and waitlist signups. If you join a mailing list (for example the Windows waitlist), we store your email address and where you signed up from with Resend, our email provider.

These tools run on trysundown.com — never inside the app:

• PostHog (US-hosted) for product analytics: pages viewed, referrer (including which AI answer engine referred you, if any), checkout steps, and A/B test variants. Requests are routed through our own domain (life.trysundown.com) before reaching PostHog. Full person profiles are created only for identified visitors, such as after a purchase.
• Vercel Analytics and Speed Insights for aggregate visit counts and page performance on our hosting platform.
• Meta (Facebook) Pixel and Conversions API. When our ads bring you here, we report events such as page views, trial starts, and purchases back to Meta so we can measure the ads. Server-side events include your click identifiers, your IP address and browser user-agent, and matching data (such as your email) hashed with SHA-256 before it is sent — never in plain text.
• Google tags (Google Analytics 4 and Google Ads conversion tracking) to measure visits and which ad clicks led to purchases. When you arrive from a Google ad, the click ID (gclid) is stored so the resulting purchase can be attributed to the ad.

First-party cookies we set ourselves:

• sd_ref — remembers the referral or affiliate link that brought you here, for 30 days.
• _sd_visitor — a random ID that links your checkout to the ad click that brought you, stored server-side for attribution.
• _sd_gclid, _sd_fbclid, _fbc, _fbp — Google and Meta ad-click identifiers, kept for 30 days, used only to attribute purchases to ads.

Stripe sets cookies on the checkout pages for fraud prevention, and the Google and Meta tags above set their own cookies subject to those companies’ policies. We also mirror the ad-click identifiers in your browser’s localStorage for the same 30-day window. Our site does not currently respond to “Do Not Track” browser signals.

We use a small set of service providers, each processing data on our behalf for the purpose named:

• Stripe — payment processing and billing.
• Supabase — our database, holding purchase and conversion records, trial registrations (keyed by machine identifier), feedback, and referral data.
• Resend — sending license keys, receipts, and service emails, and storing newsletter contacts.
• Vercel — website hosting and site analytics.
• PostHog — product analytics (US cloud).
• Cloudflare — routing of inbound email sent to our @trysundown.com addresses, so messages you send us pass through Cloudflare in transit.
• Meta and Google — advertising measurement, as described above.

Several of these providers are based in the United States, so your data may be processed there and in other countries. Where GDPR applies, transfers rely on recognized safeguards such as the EU–US Data Privacy Framework or Standard Contractual Clauses maintained by each provider. We do not sell your personal information to anyone.

• Performing our contract with you: processing your purchase, issuing and validating your license, running your trial, delivering updates, and answering support.
• Our legitimate interests: preventing fraud and abuse (rate limiting, one trial per machine, license binding), securing the service, measuring whether our advertising works, and understanding how the website is used.
• Your consent, where required — for example marketing emails, which you can withdraw at any time via the unsubscribe link in every message.
• Legal obligations: keeping transaction records for tax and accounting.

• Purchase and license records are kept for as long as your license is valid, and afterwards as long as tax and accounting law requires.
• Trial registrations are kept so the one-trial-per-machine rule keeps working.
• Feedback and support messages are kept while they are useful for improving Sundown and answering you.
• Analytics and ad-measurement data is retained per the schedules of the tools above; the ad-click identifiers we set ourselves expire after 30 days.

If you ask us to delete your data, we delete what we are not legally required to keep.

If you are in the EU, UK, or another jurisdiction with similar law, you have the right to access, correct, delete, or receive a copy of your personal data, to restrict or object to our processing of it, and to withdraw consent at any time without affecting prior processing. You also have the right to complain to your data-protection authority.

To exercise any of these rights, email hello@trysundown.com from the address associated with your purchase. We respond to every request and will ask only for what we need to verify it is really you.

We collect the categories described above: identifiers (email, license key, machine identifier, IP address), commercial information (purchases), and internet activity (site analytics, ad-click data). We do not sell personal information for money. Like most sites that advertise, we use Meta and Google measurement tools, which California law may treat as “sharing” for advertising purposes; you can opt out of this by emailing hello@trysundown.com. California residents may exercise the same access, deletion, and correction rights described above, without discrimination for doing so.

Sundown is not directed at children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided us personal information, email us and we will delete it.

When we change this policy, we update it here and revise the date at the top. Material changes to how we handle data already collected will be flagged prominently on this page or by email.

Privacy questions, data requests, or anything unclear: hello@trysundown.com. For general product support: support@trysundown.com.