Privacy

UltraDock was built to keep everything on your Mac, so this page is short. It covers two things: the app, and this website. Plain language, no surprises.

The short version

No account, no analytics. Window titles and positions are read through macOS Accessibility and processed entirely on your Mac. The app's only routine network request is a cryptographically signed update check. AI assistants are off by default. If you connect one through UltraDock's MCP server, the window details it asks for – titles, apps, positions – go to that assistant, and from there to the AI service it uses.

And this website is just as quiet – the contact form is the only place it processes personal data.

The app

Everything in this section describes the app itself: what it reads, what it keeps, and the one network request it makes.

What UltraDock reads

UltraDock needs the macOS Accessibility permission – it's the system API for listing, raising, moving and closing other apps' windows, which is the whole job. A guided setup walks you through granting it.

Through that permission, UltraDock reads window titles, positions and sizes – the information it needs to draw the window strip and to carry out what you click. All of it is processed in memory, on your Mac, and never transmitted anywhere – unless you connect an AI assistant, as described below. The same goes for the smaller details the strip shows, such as tab counts. If you use Chrome-profile color markers, UltraDock also reads the profile names from Google Chrome's local settings files on your Mac – again locally, like everything else. Full Disk Access is optional – UltraDock uses it only to read Chrome's profile list for Chrome-profile color markers.

What UltraDock stores locally

Your settings – layout, looks, behavior – along with pinned windows, window aliases (the names you give windows) and color markers are stored locally on your Mac. Your license key and the AI assistants you've approved are kept in the macOS Keychain, and so is the date your trial started – with a copy in a small local file. Nothing syncs to any server, and there is nothing to sign in to.

Settings can be exported as a JSON file (or copied to the clipboard) – but only when you ask, and the export goes only where you put it.

Screen Recording & live previews

Screen Recording permission is requested only if you turn on live previews. Everything else works without it.

When previews are on, hovering a window button renders a live preview on-screen, on your Mac. Preview frames are never written to disk and never transmitted – they exist only while you're looking at them.

AI title shortening

AI title shortening runs on-device with Apple Intelligence – window titles never leave your Mac. There is no cloud service behind the feature: the shortening happens with Apple's on-device models, and the shortened labels are cached locally so they don't have to be recomputed. Requires macOS 26 (Tahoe).

AI assistants (MCP)

AI assistants are off by default. If you connect one through UltraDock's MCP server, the window details it asks for – titles, apps, positions – go to that assistant, and from there to the AI service it uses.

The connection itself stays on your Mac: UltraDock listens on a local socket that only your user account can open – never on a network port. Each assistant has to be approved the first time it connects (Deny, Allow Once or Always Allow), and Settings lists every allowed app with a Revoke button. Closing windows and quitting apps sits behind a separate switch that stays off until you turn it on. Once window details reach an assistant, what happens to them is up to that assistant and the AI service behind it, under their own privacy terms.

Auto-updates

UltraDock keeps itself current through a built-in updater. Routinely – at most once every 24 hours, or when you check manually – it fetches a small static manifest file over HTTPS to see whether a newer version exists, and downloads the update itself when there is one. Before installing anything, the app verifies what it downloaded: the manifest's Ed25519 signature, Apple's notarization and the developer's signing identity all have to check out, or the update is discarded. The routine check is a switch: turn off Automatically check for updates in Settings, and the app checks only when you ask.

The update check is a plain file download – no query parameters, no cookies, no custom headers beyond the standard ones every request sends, among them the User-Agent, which names the app, its build number and the system version. It carries no account and no personal identifiers; like any web request, it necessarily shows the feed server your IP address, which lands in standard server logs and nothing more.

This website

This is a static website – plain pages, no account system, no sign-in. It does not use analytics or advertising cookies.

Contact form. If you write to us through the form on the FAQ & Support page, the site sends your name, email address and message through its email provider (SendGrid) so your message arrives and a reply can reach you. That data is used solely to reply to you – it isn't added to any mailing list and isn't shared for marketing.

Spam protection. The contact form is protected by Google reCAPTCHA, which loads Google resources on the form page and is subject to Google's own privacy terms. It runs only there, not across the site.

Server logs. Like virtually every website, the server hosting these pages keeps standard access logs – IP address, browser type and time of request – used for security and to keep the site running.

Purchases & licenses

If you buy a Plus or Pro license, checkout runs through Polar, our merchant of record. Polar processes the payment, so your card and billing details go to Polar, not to us – how Polar handles them is described in Polar's privacy policy.

What we keep is what license delivery needs: the email address you bought with, the tier, the amount and currency you paid, your billing country, Polar's order reference and the license key itself. That data is used to send you the key (by email, through SendGrid), to resend it when you ask, and for refunds – nothing else, and no marketing. The raw order notifications Polar sends us, which also include your name, are deleted after 400 days; the sale record and the key stay, so a key can still be resent years later. The app still has no account: it validates your key on your Mac, offline.

The refund window and the lost-key resend steps live in the license FAQ.

Your choices & contact

Questions about this policy, or requests about your data – for example, seeing what a message you sent contained, or having it deleted – go through the contact form at /faq#contact. A human reads it and a human replies.

Changes

If this policy changes in any material way, the change will be announced here, as a dated entry in the list below.

  • 2026-09-27 – Added the AI assistants (MCP) section and the optional Full Disk Access permission, and spelled out what we keep when you buy, what the app keeps in the Keychain and which standard headers the update check sends.