1. Who we are
Enalla ("Enalla", "the app", "we", "us") is a macOS menu bar application developed and published by STH Labs, the trading name of Stavros Thalassinos, a sole proprietor established in Greece (VAT/ΑΦΜ EL160320426), registered address Thesi Alonaki, Prodromos, 84400 Paros, Greece.
For the purposes of the EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and Greek Law 4624/2019, Stavros Thalassinos is the data controller for the limited personal data described in this policy.
Contact for privacy matters: stavros.thalassinos@sthlabs.net. We have not appointed a Data Protection Officer: the GDPR requires one only where core activities involve large scale regular and systematic monitoring, or large scale processing of special categories of data (Art. 37), and ours do not.
2. The one sentence version
The Enalla app makes no network connections of its own and sends nothing to us, Apple handles your purchase, and this website counts visits without cookies or any identifier that outlives the page view.
3. What the app does with data
Nothing leaves your Mac through the app. Enalla contains no networking code and runs inside the macOS App Sandbox with only the sandbox entitlement, so it cannot open a network connection of its own. It has no account, no sign in, no crash reporting and no analytics. The one exception is buying or restoring Enalla Full: the app asks the App Store service built into macOS to do that, and macOS talks to Apple (see section 4).
What it stores locally. Your settings (timer lengths, which nudges are on and their intervals,
the escalation delay, idle pause, sounds, menu bar time, launch at login, whether onboarding was completed, which
nudge you picked for the free edition, and a local copy of whether Enalla Full is unlocked) are kept in the
app's user defaults on your Mac. The timer state and today's counts live in memory while the app runs. To remove
the settings, delete the app and its folder ~/Library/Containers/net.sthlabs.enalla.
Idle detection. To pause the timer when you step away, the app asks macOS for the number of seconds since your last keyboard or mouse event. This is a single number provided by the system; the app never sees what you typed or clicked, and no permission is required.
Notifications. Nudges and phase changes are delivered through the macOS notification system on your Mac, which is why Focus and Do Not Disturb apply. Nothing about a notification is sent to us.
Launch at login uses Apple's login item service on your Mac. It is off unless you turn it on.
4. Buying through the Mac App Store
Enalla is distributed only through the Mac App Store. The free download and the Enalla Full in app purchase are sold by Apple as merchant of record, which handles payment, billing, tax, receipts and refunds as an independent controller under Apple's Privacy Policy. We do not receive your name, email address or payment details from an App Store purchase. Apple shows us only aggregated sales figures. The purchase is tied to your Apple Account, which is how restoring it works on another Mac.
Two other things can reach us through Apple, both under your control. If you turned on Share with app developers (System Settings, Privacy & Security, Analytics & Improvements), Apple may pass us crash data and a subset of analytics information for Enalla; turn it off there to stop it. And a rating or review you post on the App Store is public under the name you chose there.
5. What this website measures
This website (enalla.sthlabs.net) is a static site hosted by Vercel. It sets no cookies and leaves nothing stored in your browser.
Visit statistics (PostHog, EU cloud). When analytics is enabled on the site, each page runs
PostHog's JavaScript library, which sends events to enalla.sthlabs.net, from where they are forwarded to
PostHog's servers in Frankfurt, Germany. Your browser never contacts PostHog directly. The events are: one when
you open a page, one when you click a Mac App Store badge, one when you leave the page, and one with page speed
measurements when the page is hidden. Each event contains only: which of those it was, the page path, the website
that linked you here (host name only, never the full address), the utm_source, utm_medium and utm_campaign tags of the link if it had any, whether the visit was marked
as our own testing, whether you were on a Mac or another platform, which badge you clicked, for the page leave
event how many seconds you spent on the page, and for the speed event up to four numbers your browser measured
(time to first and largest content, input delay if you interacted, and layout shift). Every event also carries
the time it happened, the name and version of the PostHog library, the site's public PostHog project key, and a
random ID for the event itself. Events from one page view share a random ID created in memory when the page loads;
it is never stored and a new page load gets a new one. Your IP address reaches PostHog with each forwarded
request, as with any web request; PostHog is set to discard it before the event is stored and not to look up your
location from it. No browser fingerprint, no name and no email. PostHog builds no profile of you. If analytics is
not enabled, none of this code runs.
Why, and on what basis. We use these statistics to see which links bring visitors and whether the page leads them to the Mac App Store. The legal basis is our legitimate interest in understanding, in aggregate, how the site is used (GDPR Art. 6(1)(f)). You can object at any time (section 9).
Hosting logs (Vercel). Like any web host, Vercel receives your IP address and the page you requested in order to serve it, and may keep short lived request logs for security and operations (legitimate interest in running a secure website, GDPR Art. 6(1)(f)).
Email. If you write to us, we keep the correspondence to answer you (legitimate interest, GDPR Art. 6(1)(f)).
6. Third parties
The split below follows the GDPR's own definitions. A processor acts only on our instructions (Art. 4(8)); an independent controller decides its own purposes (Art. 4(7)).
Our processors:
- Vercel (Vercel Inc.): hosting this website and forwarding the visit statistics in section 5 to PostHog. Privacy policy: vercel.com/legal/privacy-policy
- PostHog (PostHog Inc.): visit statistics as described in section 5, stored in its EU cloud. Privacy policy: posthog.com/privacy
Independent controllers:
- Apple: distribution, payment and refunds for the app and the in app purchase. Privacy policy: apple.com/legal/privacy
We do not sell personal data and do not share it for advertising.
7. International transfers
Vercel Inc. and PostHog Inc. are companies based in the United States. Both state that they are certified under the EU-US Data Privacy Framework, and both may also rely on the European Commission's Standard Contractual Clauses. PostHog stores the site statistics in its EU cloud in Germany. You can ask us which mechanism applies to a given provider.
8. How long we keep data
- Visit statistics (PostHog): individual events no longer than 12 months; totals derived from them may be kept.
- Support correspondence: up to 24 months after the issue is resolved.
- App data on your Mac: controlled entirely by you; removed when you delete the app and its container folder (section 3).
- Purchase records: held by Apple under Apple's policies. We hold only aggregated sales reports, kept as long as Greek tax and accounting law requires.
9. Your rights under the GDPR
You have the right to access your data, rectify inaccurate data, request erasure, restrict or object to processing, and request data portability. In practice we hold almost nothing about you: the app sends us nothing, Apple holds the purchase, and site statistics carry no identifier that could be matched to a person.
Right to object. Where we rely on legitimate interest (site statistics, hosting logs and support email), you may object at any time on grounds relating to your particular situation (GDPR Art. 21).
To exercise any right, email stavros.thalassinos@sthlabs.net. We respond within one month. You may also complain to the Hellenic Data Protection Authority ( dpa.gr) or your local EU supervisory authority.
10. Children
Enalla is not directed at children under 16 and we do not knowingly collect personal data from them. The app collects none from anyone.
11. Security
The website is served over TLS. The most sensitive thing Enalla could touch, how you work at your desk, never leaves your Mac, so it is never exposed to us or to anyone else.
12. Changes to this policy
We will update this policy if the app or the website starts handling data differently, with a new "Last updated" date. Related document: the Terms of Use.
13. Contact
STH Labs, Stavros Thalassinos
Thesi Alonaki, Prodromos, 84400 Paros, Greece
VAT ID EL160320426
Email: stavros.thalassinos@sthlabs.net