SheetPackFOR MAC

Updated 14 September 2026

Privacy notice

This notice describes how Soo, the South Korea-based developer of SheetPack, handles information for the app, website and support. Privacy contact: soo2000925@naver.com.

Drawings stay on your Mac

SheetPack processes PDF contents, selected regions and exports locally. The app does not upload drawings or run drawing analysis on a server. Your purchase license and device-bound activation receipt are stored locally. Activation and periodic renewal use the internet, but never send drawing contents or filenames. Avoid sending confidential drawings in support emails; use a redacted or synthetic example if needed.

What is stored on your device

The app holds the opened PDF, selected regions and edited names in its current session; it does not save a separate work-session history. Exported PDFs and register.csv are written to the folder you select. The original PDF is not overwritten. The imported signed license JSON is saved in the app’s folder under your user Library/Application Support directory and remains available after restarting. It is signed for authenticity, not encrypted. The device-bound activation receipt is saved beside it. A device signing key is protected by Secure Enclave and Keychain, along with a last-seen time used to detect clock rollback. You can remove local exports and the saved license using Finder; removing the license returns the app to trial mode but does not release the server-side device binding.

Offline processing and its boundaries

The app does not use cloud AI, upload document contents or send app analytics. The trial does not contact our activation service. A paid license requires internet access for first activation and periodic renewal, with up to 7 days offline after successful activation. Downloads, checkout, license delivery and support are online services; “local processing” does not mean that our business has no servers.

Using local processing avoids sending drawings to a separate processing provider and storing them on that provider’s server. It does not guarantee absolute security. iCloud Drive, Dropbox, network folders and device backups may copy your files independently of SheetPack. Use an appropriately protected local folder and your organisation’s device and file-sharing policies for sensitive material.

SheetPack does not add password encryption or redact exported PDFs. Source contents and metadata may remain in exports; filenames and the CSV register can also disclose project information. Inspect these before sharing. Operating-system storage, backups and diagnostics are outside the app’s control; deleting a file is not a promise of forensic erasure. Apple signing and notarization help verify the distributed app, but do not encrypt your documents or guarantee freedom from vulnerabilities.

Purchase and delivery records

Our fulfillment system receives the checkout email, order ID, product/variant identifiers, payment and refund status, currency, amounts and timestamps from Lemon Squeezy. We store the signed license, delivery message and email address to fulfill the order and investigate delivery problems. We also record email provider IDs and statuses such as delivered or bounced, retry counts and operational timestamps.

We use this information to supply the product, handle support and refunds, prevent duplicate delivery and keep transaction records. These uses support the purchase contract, reliable and secure operation, and legal recordkeeping obligations where applicable. Our app and fulfillment database do not collect or store payment-card numbers; the checkout providers handle payment information.

Device activation records

To enforce one Mac per license, the app sends the signed purchase credential, a SheetPack-specific hash derived from the Mac hardware identifier, a device public key, a cryptographic proof and a request timestamp. The raw hardware identifier, serial number, MAC address, drawings, filenames and private device key are not sent. We retain the hashed device ID, public-key fingerprint, associated order/license, activation and expiry times, and any approved replacement identifiers and transfer time. These are pseudonymous identifiers, not anonymous data, because they are linked to a purchase. The device private key is protected by Secure Enclave and is not uploaded.

Cloudflare operates the activation endpoint and may process connection information such as IP addresses under its security and hosting policies. Activation records are included in encrypted operational backups. We use them to enforce the purchased device limit, stop renewals for refunded orders, resolve transfers and prevent unauthorized use. They follow the license-record retention and request process below.

Website and support

We have not added advertising trackers or marketing analytics to this site or app. Hosting and security providers may process IP addresses, browser information, request times and essential cookies under their own policies. If you email us, we receive your address, message and any attachments. We do not use order emails for a marketing mailing list without a separate opt-in.

Service providers and locations

These services may process information in South Korea, the United States and other countries where they operate. They also process some information for their own purposes under their respective policies.

Retention and deletion

We retain purchase and license records to support the ongoing license, handle refunds and disputes, and meet applicable recordkeeping obligations. These records currently have no fixed automatic deletion date. Support messages are retained as needed to resolve and document requests. Contact us to request access, correction or deletion; we review requests and explain any records that must be retained.

Scheduled encrypted GitHub backups have a 30-day retention setting. Local recovery copies are not covered by that automatic expiry and require manual deletion. Removal from an active system may therefore take longer to reach backup copies. Payment and email providers apply their own retention rules.

Your choices

Contact the address above to ask about your data, request access or correction, request deletion, or exercise other applicable privacy rights. We may ask for proportionate proof that an order belongs to you. We do not need your password, card number or government ID for an ordinary support request. You may also contact your relevant data protection authority.

We will date material changes to this notice on this page.