Privacy Policy

Effective May 7, 2026

Sash is a Mac application that arranges windows on your Mac. This page explains what data Sash touches, what it doesn't, and what choices you have.

1. Introduction

Sash is published by Alt Labs Inc., a corporation organized under the laws of Canada ("we", "us", "our"). This policy describes our practices for the Sash desktop application and the website at getsash.app.

Sash runs locally on your Mac. We do not operate a backend, do not maintain a Sash user account system, and do not log how you use the app. The product is a window manager and behaves like one.

2. What Sash is and how it works

Sash is a macOS application distributed as a signed and notarized DMG outside the Mac App Store. It snaps the focused window to a portion of the screen on a keyboard shortcut, presents a Snap Assist picker so you can fill the remaining zone with another window, groups two snapped windows so you can resize them together with a single divider, and provides an Alt-Tab-style switcher with live window thumbnails. Sash runs as a menu-bar application; there is no dock icon and no main window beyond the Settings panel.

3. Permissions Sash uses

Sash requires two macOS system permissions, which you grant during onboarding. You can revoke either permission at any time in System Settings → Privacy & Security.

Accessibility. Required to read the position, size, title, and owner of the windows you have open, and to move and resize those windows on your behalf. Sash reads window metadata only — it does not access the contents of any window.
Screen Recording. Required to capture small thumbnails of your open windows. These thumbnails are shown inside Sash's Snap Assist picker and Alt-Tab switcher. Captures are generated on demand, held in memory only while the picker or switcher is on screen, and are not written to disk or transmitted off your Mac.

Sash does not record video, take persistent screenshots, log keystrokes, or read clipboard contents.

4. What Sash sends off your Mac

Sash makes a network request in two situations only:

License activation and verification. When you enter your license key, Sash contacts the Lemon Squeezy License API to verify the key is valid and to register this Mac as one of your activated devices. The request includes your license key and a device label derived from your computer's network name (for example, "Alex's MacBook Air") so you can identify the device in your account dashboard. After activation, Sash reverifies the license in the background once per launch. If Lemon Squeezy explicitly reports the device as deactivated, Sash returns to the free tier. The reverification is non-blocking — Sash continues to operate on cached state when the network is unavailable.
Update checks. Sash uses the open-source Sparkle framework to check for new versions. The check fetches an XML feed from updates.getsash.app; when an update is available, Sparkle downloads the release archive from github.com. These requests carry no identifying payload beyond the standard HTTP headers your operating system sends with any web request.

That is the complete list. There is no other situation in which Sash transmits data off your Mac.

5. What the website collects

The website at getsash.app is a static site. It does not set cookies, does not use any analytics or tracking service, and does not load any third-party scripts that profile you. Standard server-level access logs may exist at our hosting provider for operational and security purposes; we do not read or process them for any other purpose.

6. Third-party processors

To deliver the service, we rely on a small number of third-party providers. Each operates under their own privacy policy.

Lemon Squeezy (Lemon Squeezy LLC) is our merchant of record. They handle checkout, payment processing, tax compliance, license-key issuance, and the customer portal at manage.getsash.app. They collect payment details, billing email, and the IP address used at purchase. See Lemon Squeezy's Privacy Policy for details.
GitHub (GitHub, Inc.) hosts our release archives and Sparkle update feed. When Sash checks for updates or downloads a new release, your operating system makes a standard HTTP request to GitHub's servers. See GitHub's Privacy Statement.
Apple (Apple Inc.) signs and notarizes Sash. macOS performs notarization checks against Apple's servers when you launch a Developer-ID-signed application. See Apple's Privacy Policy. We do not control these checks and receive no information about them.

7. What we do not collect

We do not collect telemetry, usage analytics, crash reports, advertising identifiers, IP addresses, device fingerprints, or any record of your activity inside Sash. There is no Sash account. There is no Sash server that learns about you. Nothing about the windows you arrange, the apps you use, or how you use Sash is transmitted anywhere.

If a future version of Sash adds optional crash reporting or diagnostics, we will announce the change on this page and in-app at least 30 days before it ships, and the feature will be opt-in.

8. Data retention

Because Sash does not collect personal data on our side, there is nothing for us to retain on our side. Data held by Lemon Squeezy in connection with your purchase is retained per their policy and applicable tax-record laws. License records on your Mac are stored in the macOS Keychain and removed when you deactivate the device or uninstall the app.

9. International transfers

Lemon Squeezy and GitHub may process data outside your country of residence, including in the United States. By purchasing Sash, you acknowledge that your payment and licensing data may be transferred to and processed by these providers in their respective jurisdictions, subject to their privacy policies.

10. Your rights

Depending on where you live, you may have rights regarding your personal data — including the right to access, correct, delete, or export it, the right to object to or restrict its processing, and the right to lodge a complaint with a data protection authority.

Quebec residents (Bill 25 / Law 25). If you are a resident of Quebec, you have rights under An Act respecting the protection of personal information in the private sector.
EU/UK residents (GDPR / UK GDPR). If you are in the European Economic Area, the United Kingdom, or Switzerland, you have rights under the relevant General Data Protection Regulation.
California residents (CCPA / CPRA). If you are a California resident, you have rights under the California Consumer Privacy Act, as amended.

Because we do not collect personal data directly, most data-subject requests should be directed to Lemon Squeezy in their capacity as the merchant of record for your purchase. For requests that concern Alt Labs Inc. directly, write to hello@getsash.app and we will respond within 30 days.

11. Children's privacy

Sash is not directed to children under 13. We do not knowingly collect personal information from children. Because we do not collect personal information from anyone, this provision is largely moot, but it is stated for completeness.

12. Changes to this policy

If we change this policy in a material way, we will post a notice in the site footer at least 30 days before the change takes effect, update the effective date at the top of this page, and notify active license holders by email where reasonably practicable.

13. Contact

For privacy questions, write to hello@getsash.app.