Mokki is a macOS app for creating device mockups, operated from Portugal. This Privacy Policy explains what information we handle when you use the Mokki website, Mac app and customer portal (together, the "Service"), and why. Mokki is the controller of this information.
The short version: your screenshots and projects never leave your Mac. We keep only what we need to sell, license and support Mokki, and we do not sell personal information or use advertising trackers.
1. Information we handle
Your work in the app
Screenshots, projects, scenes and exported images stay on your Mac. Mokki has no analytics or tracking SDKs and does not send your content to us or anyone else.
Purchases
Stripe processes checkout and payment as merchant of record. Mokki never receives your full card details. After a purchase, Stripe sends us your email address, an order reference, the amount and currency, and the payment status. We use these to issue your license, email you your key and handle refunds.
Account
If you create an account, we store:
- your email address and whether you verified it;
- your password, only as a salted one-way hash that cannot be turned back into the password;
- your active sign-in sessions, with the IP address and browser user agent used to start them, so you can see them and we can detect misuse.
Licenses and activation
When you activate, check or deactivate a license, the Mac app sends:
- your license key. We store it encrypted, so we can show it to you in the portal, plus a hash used to look it up;
- a device identifier, which is a one-way hash derived from your Mac's hardware ID. We cannot recover the hardware ID from it;
- your Mac's name, so you can recognise it in the portal;
- the Mokki version.
We record when the license was activated and last checked. The app keeps a signed license token on your Mac so Mokki keeps working offline.
Updates
To check for updates, the app downloads an update feed from releases.getmokki.com. That request includes your IP address and the app version, like any web request. Mokki does not send a system profile with update checks.
Website, portal and email
Cloudflare hosts the website and portal and processes basic request and security information, such as IP addresses, to deliver and protect them. The portal uses one strictly necessary cookie to keep you signed in. We do not use advertising or analytics cookies, so there is no cookie banner.
We send account and license emails, such as email verification, password reset, license keys and activation notices, through Cloudflare. We do not send marketing email without your consent.
Support
If you contact us, we keep the correspondence and anything you choose to include in it.
2. Why we use it
- To provide what you bought (performance of a contract): issuing and delivering licenses, activation, the customer portal, account emails and support.
- To keep the Service secure (legitimate interests): rate limiting, preventing license abuse and fraud, and keeping logs of security events.
- To meet legal obligations: keeping purchase records as required by tax and accounting law, and responding to lawful requests.
We do not sell personal information, and we do not use it for advertising or profiling.
3. Service providers
- Stripe handles checkout, payment, receipts, invoices and taxes as merchant of record, under its own privacy policy.
- Cloudflare hosts the website, portal and database, runs background jobs and sends email, as our processor.
These providers may process information outside the European Economic Area. Where they do, the transfer is covered by safeguards such as the EU Standard Contractual Clauses or the EU-US Data Privacy Framework.
4. How long we keep it
- Account: until you delete it.
- Sessions: until you sign out or they expire, at most 30 days.
- Email verification and password reset links: until used or expired, then deleted.
- Orders and licenses: for as long as the license exists, and order records for as long as tax and accounting law requires, which in Portugal is up to 10 years.
- Deactivated devices: up to 12 months after deactivation, to help prevent abuse.
- Security and request logs: a short period, typically no more than 30 days.
- Support correspondence: as long as needed to help you and meet legal obligations.
If you delete your account, your licenses keep working and remain linked to the purchase email address, so you can sign up again to manage them.
5. Your rights
Under the GDPR you have the right to access, correct, export or delete your personal information, to restrict or object to certain processing, and to withdraw consent where we rely on it. You can change your email, change your password and delete your account yourself in the customer portal. For anything else, email us. Some purchase records must be kept for legal reasons even after you delete your account.
You can also complain to a data protection authority. In Portugal this is the Comissão Nacional de Proteção de Dados (CNPD), and you may contact the authority in the country where you live.
6. Security
We store license keys encrypted, sign-in tokens as hashes, passwords as salted hashes, sign license tokens cryptographically, and limit how often sign-in and activation can be attempted. No system is perfectly secure. If we learn of a breach that affects you, we will tell you and the relevant authority as the law requires.
7. Children
The Service is not directed at children under 16, and we do not knowingly collect their information.
8. Changes
We may update this policy as the Service changes. The new version will be published here with a new date, and we will email account holders about significant changes.
9. Contact
Privacy questions and requests can be sent tosupport@getmokki.com.