English translation for convenience; in case of conflict the Romanian version prevails.
Version 1, 16 October 2026. Controller: Emil Danilesco, natural person, Anenii Noi, Republic of Moldova (full address on request, by e-mail), contact@getupsi.com.
To be reviewed by a lawyer before publication. Law no. 133/2011 on personal data protection (Republic of Moldova) applies and, for users in the European Union, the GDPR.
Upsi is built so that your data stays with you. Photos, screenshots and location are taken on your Mac and go, if you want, straight to your own Telegram chat. We do not receive them, see them or keep them. The only things that reach us are those needed for the app to know whether the trial period is running and who has paid.
| Data | When | Where it stays | How long |
|---|---|---|---|
| Camera photos (the person in front of the Mac) | on wake, wrong password, login, lock, on request from Telegram | the folder you choose, by default Pictures → Upsi | deleted automatically after the number of days you choose (default 30) |
| Screenshots | after a login, at the minutes you choose, or on request | the same folder | the same |
| Approximate location of the Mac | on alerts, if you have allowed location | only in the message sent to Telegram and in the log | the log stays on your Mac |
| App log (what happened and when) | continuously | ~/Library/Logs/Upsi.log | until you delete it |
| "Shoulder Watch" frames | at every check, while the feature is on | not saved and not sent; by default they are analysed and discarded on the spot | only if you turn on "Save the frame" or "Also send the frame" |
| Number of faces and gaze direction | at every check | in memory, for a fraction of a second | not kept |
The face analysis in "Shoulder Watch" counts faces and estimates head direction using Apple's functions on the Mac. It does not identify people and does not create biometric profiles.
To Telegram (only if you have connected a bot): photos, screenshots, location and status messages go from your Mac to Telegram's servers, into the chat between you and your bot, using your bot's key. We have no access to this bot or this chat. Telegram's policy applies to the data on Telegram.
To us (the Upsi server), at startup and then at most once a day:
We do not receive photos, screenshots, location, user names or the content of messages.
To Lemon Squeezy (the seller on our behalf, Lemon Squeezy LLC, USA), when you buy: e-mail, country, payment details (only the payment processor sees these, not us). Lemon Squeezy issues the licence key and the invoice. The app periodically checks the key with Lemon Squeezy, sending the key and an identifier of the installation. Their policy: lemonsqueezy.com/privacy.
To Apple: nothing from us. macOS checks the app's signature when it is first opened, according to Apple's policy.
For the photos taken by the app, the data controller is you, the user: you decide what you photograph, what you keep and who you show it to. Upsi is a tool, like a security camera for your own property. Use it only on your own Mac and respect the law of the place where you are.
Data on our server: as long as the installation or licence exists, plus 12 months after the last activity, then it is deleted. The optional e-mail: until you delete it or ask us to delete it. Payment data: at Lemon Squeezy, in line with tax obligations.
You have the right to find out what data we hold about you, to correct it, to delete it, to object to processing and to receive it in a readable format. Write to contact@getupsi.com with the Mac identifier (Settings → License → "This Mac's identifier"); we reply within 30 days at most. If you are in the EU, you can lodge a complaint with the data protection authority of your country; in Moldova, with the National Center for Personal Data Protection.
Upsi is not aimed at people under 16 and we do not knowingly collect data from them.
Connections to our server and to Lemon Squeezy are encrypted (HTTPS). The app's files on the Mac are accessible only to your user. The Telegram bot key stays on your Mac; do not send it to anyone.
The new version is published on the website with its date; important changes are announced in the app.
Emil Danilesco, natural person, Anenii Noi, Republic of Moldova (full address on request, by e-mail), contact@getupsi.com.
Republic of Moldova. The controller is Emil Danilesco, natural person, registered under Law no. 133/2011. Supervisory authority: the National Center for Personal Data Protection (datepersonale.md). The data on our server is hosted at Cloudflare, in data centres in the European Union and the United States; transfer outside Moldova is made on the basis of the provider's contractual clauses.
European Union and EEA (GDPR).
United Kingdom (UK GDPR and Data Protection Act 2018). The same rights as in the EU. Authority: the Information Commissioner's Office (ico.org.uk). UK representative: [TO BE DECIDED WITH THE LAWYER].
United States. We do not sell or "share" personal data within the meaning of the laws of California (CCPA/CPRA), Virginia, Colorado, Connecticut, Utah, Texas and the other state privacy laws; we do not do targeted advertising and do not use data for profiling. Residents of these states have the right to know, delete and correct their data and not to be discriminated against for exercising their rights; requests are sent to contact@getupsi.com and are honoured within 45 days. We do not knowingly collect data from children under 13 (COPPA); our general limit is 16 years.
Canada (PIPEDA and provincial laws, including Québec's Law 25). We collect only the data needed for the purposes described, with your consent or on the basis of the contract. Person responsible for data protection: Emil Danilesco, contact@getupsi.com. You may contact the federal Privacy Commissioner or the commission of your province.
Switzerland (nLPD/FADP, 2023). The same principles as the GDPR; authority: the Federal Data Protection and Information Commissioner (edoeb.admin.ch). Transfers abroad are based on standard contractual clauses recognised by Switzerland.
Brazil (LGPD). The rights under Art. 18 LGPD are exercised at contact@getupsi.com; the grounds are performance of the contract, legitimate interest and consent.
Other countries. We apply the same rules everywhere: minimum data, no selling, no ads, deletion on request. If your law gives you additional rights, we respect them.
| Provider | Role | Country | What it receives |
|---|---|---|---|
| Lemon Squeezy LLC | seller on our behalf, payments, invoices, licence keys | USA | e-mail, country, payment details (at their processor), the key and the installation identifier at verification |
| Cloudflare, Inc. | hosting of the website and of the licence server | USA, with data centres in the EU | the Mac identifier (shortened), trial date, version, language, optional e-mail; technical connection logs (IP address), kept briefly by the provider |
| Telegram | the messaging service you chose | United Arab Emirates | data goes from your Mac to your bot; we are not a party |
| Apple | operating system | USA | checking of the app's signature, according to Apple's policy; nothing from us |