Privacy Policy

Last updated: October 16, 2026

MoreRoom is a storage manager that works on your Mac. The names, paths and contents of your files never leave it. This policy explains the little personal data we do handle — mostly to sell you a licence and let you activate it — why, for how long, who else sees it, and what you can do about it.

Scope and who is responsible

This policy covers the MoreRoom app for Mac, the website moreroom.app and the licence server api.moreroom.app. It does not cover websites we link to.

The controller of your personal data is Yando Pte. Ltd., a private company limited by shares incorporated in Singapore, registered office 68 Circular Road, Singapore 049422, UEN 202018750D (registered with ACRA, Singapore).

Privacy questions and requests go to our Data Protection Officer: [email protected]. Anything else: [email protected].

Singapore law governs our services and the Personal Data Protection Act 2012 (PDPA) is our home regime. The EU General Data Protection Regulation (GDPR) and the UK GDPR also apply when we offer MoreRoom to people in Europe and the United Kingdom, and this policy is written to meet them.

The short version

  • Your files stay on your Mac. Scans run locally; file names, paths and contents are never uploaded.
  • No account, no tracking. The app has no advertising, no analytics and no tracking. This website sets no cookies.
  • Buying Pro means Stripe processes your payment, and our licence server keeps your email, a hash of your licence key, your plan and dates, and the Macs you activate.
  • We never sell personal data, and we never use it for advertising.

What stays on your Mac

To show your disk, MoreRoom reads file-system information on your Mac: names, sizes, dates, locations and types of files and folders. It does not open or read the contents of your documents. Results are cached locally so the next scan is faster, together with your settings and your clean-up history (used for Undo). All of this stays on your Mac; deleting the app and its data removes it.

If you grant Full Disk Access, MoreRoom can measure folders that macOS otherwise hides. The same rule applies: measurements stay on your Mac.

What the app sends, and when

The app connects to our servers only for the following, and none of these requests contains information about your files:

  • Licence activation and renewal (Pro only): your licence key, a device hash — a SHA-256 of a hardware identifier combined with an app-specific salt, never the identifier itself — and the name of your Mac, so you can recognise it in the list of activated Macs. The server answers with a signed token that the app checks offline; it is renewed from time to time.
  • Rule catalogue updates: the app downloads a signed list of known space consumers. The request carries no personal data beyond what any internet request reveals (your IP address).
  • App updates: the app checks whether a new version is available, in the same way.
  • Optional AI explanations (when this feature ships, and only if you ask for one): the metadata of the single item you ask about — such as its kind, name, publisher, code signature or launch command — is sent with your licence token to our server, which asks an AI provider for a plain-language explanation. File contents are never sent.

What we keep when you buy Pro

  • your email address, to send your licence key and recover it if you lose it;
  • a hash of your licence key (SHA-256) — we cannot read your key back from it;
  • your plan (Pro Yearly or Pro Lifetime), its status, and its dates (purchase, renewal, end of period, refund or cancellation);
  • Stripe reference numbers (customer, subscription, payment and checkout session identifiers), to handle renewals, refunds and our accounts;
  • for each Mac you activate: the device hash, the Mac’s name, and when it was first and last seen.

Right after checkout, your new key is also kept encrypted for at most one hour so that the thank-you page can display it once; it is deleted as soon as it is shown.

Payments run through Stripe. Card details are entered on Stripe’s infrastructure and never reach us. Stripe receives your email, payment details and billing country (to calculate tax) and acts under its own privacy policy.

This website

moreroom.app sets no cookies and uses no analytics, advertising or tracking. It is served by Cloudflare, which processes your IP address, browser information and the pages requested to deliver the site and protect it from attacks.

The thank-you page sends the Stripe checkout session identifier found in its address to our API in order to display your key. The “Lost your key?” form sends the email address you type to our API. To prevent abuse, the API keeps short-lived counters keyed by IP address (and by a hash of the email address for key recovery); they expire within about an hour.

Why we process it, and on what legal basis

  • Performing our contract with you: delivering, activating, renewing and recovering your licence, handling refunds, answering support requests.
  • Legal obligations: keeping tax and accounting records.
  • Legitimate interests: preventing fraud, licence abuse and attacks, and keeping our services secure, using the minimum data needed.
  • Consent: optional AI explanations, which you request item by item and can stop using at any time.

Under the PDPA, we collect, use and disclose personal data only for these purposes, which we notify to you here, with your consent or where the PDPA otherwise permits it.

How long we keep it

  • Licence records: as long as your licence exists, then for as long as tax and accounting law requires.
  • Activated Macs: until you deactivate them, or the licence record is deleted.
  • Thank-you page keys: deleted after one display or one hour.
  • Abuse-prevention counters: about one hour. Server logs at Cloudflare: a short period set by Cloudflare.
  • Support emails: up to three years after the last exchange.

Who else processes it

We share personal data only with service providers that process it on our behalf and under contract:

  • Stripe — payments, tax calculation, receipts and subscription management;
  • Cloudflare — website hosting, the licence server and its database, and email delivery;
  • Anthropic — only for optional AI explanations, once that feature is available: it receives the item metadata described above, not your email or your files.

We may also disclose data where the law requires it, or to a successor if the MoreRoom business is transferred, under the same commitments. We do not sell or rent personal data.

International transfers

We are based in Singapore and our providers operate worldwide, including in the United States and the European Union. When personal data leaves the EU/EEA, the UK or Singapore, we rely on adequacy decisions or on the standard contractual clauses in our providers’ data processing terms, and on comparable protection as required by the PDPA.

Your rights, and how to use them

Depending on where you live, you can ask us to access your personal data, correct it, delete it, export it, restrict or object to its use, and withdraw your consent. Write to [email protected] from the email address you used to buy MoreRoom, so that we can identify you.

We answer within 30 days. If we delete your licence record, we can no longer recover your key or verify your activations, and Pro stops working when the current token expires. Withdrawing consent does not affect what was done before.

You can also complain to a supervisory authority: in Singapore, the Personal Data Protection Commission (PDPC); in the EU/EEA, the authority of the country where you live or work; in the UK, the Information Commissioner’s Office (ICO).

Security

Traffic is encrypted (HTTPS). Licence keys are stored only as hashes; licence tokens are signed (Ed25519); the thank-you-page key is encrypted (AES-GCM) and short-lived. Access to production systems is restricted to the people who need it. No system is perfectly secure; if a breach affecting your data occurs, we will notify you and the authorities as the law requires.

Children

MoreRoom is not directed at children under 16, and we do not knowingly collect their personal data. If you believe a child has given us personal data, write to us and we will delete it.

Changes to this policy

We may update this policy. The date at the top of the page is the date of the version in force. If a change is significant, we will announce it on the site or by email before it applies.

Contact

Data Protection Officer: [email protected]. General enquiries: [email protected]. By post: Yando Pte. Ltd., 68 Circular Road, Singapore 049422.

This policy is published in several languages. The English version is the binding one; if a translation differs, the English text prevails.