What goes out
Your license key and a short label for this Mac, so the same key can be moved between machines. The label is a hardware model and a random tag. Not your computer name, not a serial number, and nothing you have typed.
Privacy
Your typing.
On your Mac.
Hamburger reads keystrokes to do its job. You should know exactly where they go, what is retained, and what the app can reach before granting it access.
Processing and local storage.
- Keystrokes and corrections are processed on your Mac. They are not sent to our servers.
- Your adaptive model, including vocabulary and correction preferences learned from you.
- Pinned, blocked, and custom words you explicitly manage.
- Usage counters for your eyes only. Activity stores counts, never the words you typed.
- Practice history, stored locally and independently resettable.
No account is required. No profile, no password, and no typing history sitting in someone else’s database.
Activation and update checks.
Two things reach the network, and neither one carries what you type. Licensing runs through our own activation service. Update checks fetch a file from our own host.
What comes back
The email address from your purchase, whether the key is valid, and how many of your allowed activations are used. All of it is stored on this Mac so the app can show who it is licensed to and free the slot again later.
What happens next
Nothing. There is no repeat check, no heartbeat, and no expiry call. Once a Mac is activated the app never contacts the license server again unless you deactivate it.
Update checks
Hamburger Keyboard asks dl.hamburgerkeyboard.com whether a newer version exists. That is a public file: the app downloads it and compares version numbers here, sending no identifier and nothing about your Mac. Sparkle, the updater we use, is able to report your macOS version and hardware model along with the request, and we have that switched off. The first time it would check, it asks whether you want automatic checks at all, and declining is a real answer.
If Hamburger Keyboard quits unexpectedly, macOS writes a local crash report. It lists where in our code the crash happened and your Mac and macOS versions. It contains nothing you typed, and the app never sends it on its own: a prompt lets you look at the report and, only if you choose to, email it to us yourself.
You do not have to take any of this on faith: an outbound firewall such as Little Snitch or LuLu shows exactly what the app contacts.
Keyboard permissions.
A system-wide keyboard layer cannot work without hearing keys and writing the resolved word back. Hamburger explains both jobs before sending you to System Settings.
Protected fields and paused apps.
Hamburger corrects ordinary text fields across macOS. It deliberately does not touch secure input: when macOS marks a field as a password field, correction switches off and your keystrokes pass straight through untouched.
The protection follows the field, not what you type into it. A password typed into an ordinary text box, such as a web form that doesn't mark its password field as secure, is handled like any other word, and can be learned into your adaptive model on your Mac. It never leaves your Mac, and you can remove it in the Words section with Forget, or with Forget and never learn again. Reset learned data clears everything the app has learned.
You can extend that to anything else. Pause correction in a terminal, a password manager, a remote desktop session, an IDE, or any app you name, and it stays paused there.
Where correction works reliably, and where it does not yet, is on the compatibility page.
Website, purchases, and support.
Cloudflare hosts the site. It sees request information such as your IP address because it serves you the page, and it sets no cookies for us. There is no advertising profile and no cross-site tracking. We use Cloudflare's cookie-free page-view analytics elsewhere on the site. The activation and goodwill pages load none: our page code omits it, and we check for it on every release.
We also keep a few counts of our own: whether people try the demo, and which pages lead them to download or buy. When someone first types into the demo on the home page, or presses one of the buttons for download, pricing, or checkout, the page tells our server at activate.hamburgerkeyboard.com which of those happened and on which page. Nothing else goes with it: no cookie, no identifier, never the words typed into the demo, and we do not store the IP address it arrives from. The counts are kept for three months, and the activation and goodwill pages send none.
Activation runs on our own server at activate.hamburgerkeyboard.com. When you activate, it receives your license key and the short label for that Mac, and it stores them next to the email address from your order so we can find your license when you write to us. Deactivating a Mac frees the slot for another install. That alone does not erase the record: it stays on file, marked inactive, unless you ask us to remove it. We also keep the order tied to your license: the amount you paid, the currency, the order ID from the payment processor, its status, and a copy of the payment webhook itself.
Checkout is not open yet. When it opens, a merchant of record will handle payment and tax, and it will never see your license key.
There is no Hamburger Keyboard account.
Neither this website nor our activation service receives the words you type.
Support mail, access, and deletion
Email sent to [email protected] is kept as long as it is useful for support and warranty history. To see or delete what we hold about you, or to get a copy of your order record, write to that address. Purchase records that tax law requires us to retain are the one thing we cannot delete on request.
Goodwill requests
The goodwill form uses Cloudflare Turnstile to help prevent automated submissions. Requests go to our activation service. We store your email address, confirmation-token hash, request status, and timestamps. Resend delivers confirmation and approved-license emails. Financial documents and explanations of personal circumstances are not requested.
For abuse prevention, we keep short-lived request counters, including a secret-keyed network-address hash that rotates daily. Raw IP addresses are not stored in the request database; Cloudflare processes network information to serve and protect the service. Unconfirmed requests expire after 24 hours and are removed during daily cleanup. Unapproved requests are removed after 90 days. Approved requests remain linked to the license for support and duplicate prevention. You can contact us to request deletion.
Changes
If this policy changes in a way that affects what leaves your Mac, we announce it in the release notes and on this page before the release that makes it true. If a change ever reaches you without that notice, that is our mistake: write to [email protected] and we will honor the version you agreed to until we fix it.
Effective 10 September 2026.