Shucker
Shucker ("the app") opens and extracts Apple .dmg disk images on Windows. We collect
as little as possible. This policy explains what the app handles and why.
When you activate or verify a licence, the app sends the following to our licensing provider, Lemon Squeezy:
| Data | What it is | Why |
|---|---|---|
| Licence key | The key you purchased | To activate / validate / deactivate your licence |
| Device identifier | A one-way SHA-256 hash of your Windows installation ID (MachineGuid), namespaced to this product |
To "node-lock" the licence to one machine and enforce the one-device limit |
MachineGuid never leaves
your computer — only the irreversible hash is sent, and it is not usable to identify you
personally.The Store version ties your purchase to your Microsoft account through the Store's own in-app purchase system. It does not compute or transmit a device fingerprint, and we do not receive your account details — Microsoft handles the transaction under its own privacy terms.
The app has no automatic crash reporting or telemetry. If something goes wrong, you can choose to send us a diagnostic report to help us fix it — but a report is transmitted only when you click "Send report", after the app has shown you the exact contents. Nothing is ever sent automatically. Even after an unexpected close (a crash), the app does not send anything on its own: on the next launch it asks whether you want to send a report and shows it to you first. You can always choose "Save to file" instead of sending, and send it yourself (or not at all).
What a report contains. A single plain-text file of key: value lines, plus the
last ~200 lines of the app's in-memory activity log. Specifically: the app version, channel, and build
(git) revision; your Windows version and CPU architecture; a timestamp; the kind of error and its
underlying technical detail; if the app crashed, the panic message, source location, and a backtrace;
the shape of the disk image involved (its size, filesystem type, and whether it is encrypted —
yes/no only); and an optional "What happened?" note that you type yourself.
What is always excluded or truncated. Before a report can be previewed, saved, or sent, it is redacted:
Where reports go, and for how long. Reports are sent to a service we operate ourselves on Cloudflare — a Cloudflare Worker that stores them in a Cloudflare D1 database on our own account. That is the only processor involved: there is no third-party form service, no email provider, and no analytics or crash-telemetry SDK. Stored reports contain no IP address, and they are automatically deleted after about 90 days.
This policy covers shucker.app as well as the app, and the two behave differently — so this section says plainly what the website does.
The site uses Cloudflare Web Analytics. It is cookieless: it sets no cookies, stores nothing on your device, uses no persistent identifier, and does not fingerprint you or follow you across other websites. It records aggregate visit measurements — the page visited, the referring page, your approximate country, and browser/device type derived from your request — so we can tell whether anyone is finding the site.
There is no advertising network, no ad tracking, and no data broker involved, and we do not sell or share this data. The app itself contains none of this — installing Shucker does not put any analytics on your computer.
We (via Lemon Squeezy) keep your licence record and the associated hashed device identifier for as long as your licence is active, and as needed for support, refunds, fraud prevention, and legal/tax obligations. You can free your device slot at any time using "Deactivate this PC" in the app.
Depending on where you live (e.g. EU/UK GDPR, California CCPA/CPRA), you may have the right to access, correct, delete, or port your data, and to object to certain processing. To exercise these rights, contact us at privacy@shucker.app. Because the device identifier is an irreversible hash we cannot link to a person on its own, we may ask for your licence key or purchase email to locate your records.
The app is not directed to children under 13 (or the minimum age in your jurisdiction) and we do not knowingly collect their data.
We may update this policy; we'll change the "Effective date" above and, for material changes, note it on our website.
Questions about privacy: privacy@shucker.app
Red Spectrum LLC — postal address available on request.