LEGAL

Privacy Policy

How Worktr handles your data. Your code stays on your Mac; we only keep what we need to run your account and license.

Last updated: November 3, 2026

Who we are

Worktr is a macOS application, command-line tool and website provided by Didaska (DIDASKA LTDA, CNPJ 66.904.784/0001-90, Rua Visconde do Rio Branco, 1488, Conjunto 909, 9th floor, Curitiba, Paraná, Brazil) (“Didaska”, “we”, “us”). This policy explains what personal data we process when you use Worktr, why, and the choices you have. Questions: worktreapp@gmail.com.

The short version

Your source code, repositories and scan results stay on your Mac. Worktr does not upload them.
We only keep what we need to run your account and license: your Apple sign-in identifier, email address, purchase status and the devices you activate.
Payments are handled by Stripe. We never see or store your card details.
Worktr AI is optional and uses your own Anthropic API key. Only the details of a finding are sent, and code excerpts only if you turn that on.

Data that stays on your Mac

Repository paths, file lists, detected technologies, scan results, findings, triage decisions, reports and settings are stored in a local database on your Mac. Your Anthropic API key, if you add one, is stored in the macOS Keychain. We have no access to this data, and it is removed when you delete Worktr’s data folder.

Data we process

Account: when you sign in with Apple, we receive a stable Apple user identifier, your email address (which may be an Apple private relay address) and, on first sign-in only, your name if you choose to share it.
License and devices: a random identifier for each Mac where you activate Worktr, a one-way hash of the Mac’s hardware identifier, which ties the license to that Mac, the app version, and when each license was issued and refreshed. Licenses are signed so they can be checked offline.
Purchases: Stripe processes your payment and tells us the purchase status, amount, currency and a Stripe customer identifier. We do not receive your card number.
Security logs: sign-in, purchase and license events with a timestamp and a one-way hash of the IP address, used to prevent abuse and fraud.
Support: the messages you send us by email.
Website: our hosting provider processes standard technical data, such as IP address and browser type, to deliver the site.

Optional integrations

Worktr AI sends a finding’s rule, title, severity, file path and redacted evidence directly from your Mac to Anthropic, using your own API key and your own agreement with Anthropic. Code excerpts around a finding are sent only if you enable “Share code excerpts” in Settings. We do not receive or store these requests. Scanners may download vulnerability databases and rules from their official sources. OSV-Scanner sends package names and versions, never your code, to OSV.dev to check for known vulnerabilities. Installing a scanner downloads it from its official source, such as GitHub or PyPI, and Worktr checks GitHub for new versions of itself. You can turn automatic update checks off in Settings.

How we use data

To create and secure your account and keep you signed in.
To process purchases, issue licenses and restore them on your Macs.
To prevent fraud, abuse and unauthorized use of licenses.
To answer support requests and send essential service messages. We do not send marketing email without your consent.
To comply with legal, tax and accounting obligations.

Legal bases

We process data to perform our contract with you (account, purchases and licenses), for our legitimate interests in keeping Worktr secure and preventing fraud, to comply with legal obligations, and with your consent where required. This applies under Brazil’s LGPD (Law 13.709/2018), the EU and UK GDPR, and similar laws.

Who we share data with

We do not sell your personal data or use it for advertising. We share it only with service providers that process it on our behalf: Apple (Sign in with Apple), Stripe (payments), Cloudflare and our hosting providers (API and database), Framer (website) and GitHub (app downloads). We may disclose data when required by law or to protect our rights and users.

International transfers

Our providers may process data outside your country, including in the United States. When that happens, we rely on safeguards recognized by applicable law, such as standard contractual clauses.

How long we keep data

We keep account and license data while your account is active. Purchase records are kept for as long as tax and accounting laws require. Security logs are kept only as long as needed to prevent abuse. When you delete your account, we delete or anonymize the rest.

Your rights

You can ask to access, correct, export or delete your personal data, to object to or restrict its processing, and to withdraw consent. Email worktreapp@gmail.com from the address linked to your account and we will reply within the time required by law. You can also contact your local data protection authority, such as Brazil’s ANPD.

Security

We use encryption in transit, signed licenses, access controls and least-privilege credentials. Database backups are encrypted. No system is perfectly secure; if we learn of a breach that affects you, we will notify you as required by law.