The app can't reach the internet
ColdArchive runs inside the macOS sandbox and does not hold the network entitlement (com.apple.security.network.client). Without it, macOS blocks the connection itself. Rather than asking you to trust us, here's how to check:
codesign -d --entitlements - /Applications/ColdArchive.appYou'll see file permissions and the sandbox in the output, and no network entry.
What it does with your files
The app only ever looks inside folders you picked yourself. macOS blocks everything else.
- It moves files. It doesn't read or analyse what's in them.
- A shortcut (symlink) stays where the file was. Names and paths don't change.
- The destination is a folder you chose — a cloud sync folder, an external drive, whatever. The app just puts the file there. Uploading is done by the Google Drive or iCloud app you already run, in its own way.
Logs
The app records what it moved and when. Those records include file paths.
- They live on this Mac (
~/Library/Logs/) and never leave it. - They're deleted automatically after 90 days by default. You can change that in settings.
- We can't see them. Even when helping you troubleshoot, we only see what you choose to send us.
The weather backdrop — the one exception
Showing real weather behind the mascot is off by default. If you never turn it on, none of this applies. The default, “seasonal scenery”, only reads the date and uses no internet at all.
If you do turn it on, the internet connection is made by a small helper installed alongside the app (WeatherBridge), not by ColdArchive itself. That helper, in turn, has no permission to touch your files. That's the whole point of splitting the permissions in two.
- What is sent: the city name you typed. It goes to Apple's WeatherKit. What happens after that is covered by Apple's Privacy Policy.
- There is no server of ours. Nothing reaches Deep-On.
- Location: read once, only if you press “find my city”. The coordinates are used to look up a city name and are never stored or transmitted — only the city name remains. Type the city by hand and location is never read at all.
This website
This page has no analytics, no ads, and not one external script. Fonts and images are all served from the same place. No cookies are set.
One honest footnote: this site is hosted on GitHub Pages, and GitHub records visitor IP addresses in its server logs. That part is outside our control, and we have no access to those logs. Details are in GitHub's Privacy Statement.
Payment
Payments are handled by Paddle, the merchant of record for every purchase. Your card details go to Paddle and never reach us — we can't see them and don't store them.
What does reach us is your email address, so we can send you your licence key. It passes through Keygen, which issues the key, and Resend, which delivers the mail. It is used for nothing else — no newsletter, no profiling, and we never sell or share it. Ask at support@deepon.kr and we'll delete it.
What we hold, and on what basis
The only personal data we hold is your email address, and only if you have bought a licence. The legal basis is performance of a contract (GDPR Art. 6(1)(b)) — we need it to send you the key you paid for. There is no consent form because there is nothing optional to consent to. We keep it for as long as your licence is valid, so we can re-send the key if you lose it, and we delete it when you ask.
Your rights over that data
Wherever you live, you can ask us to do any of the following, free of charge:
- See it — get a copy of what we hold about you.
- Correct it — if the address is wrong.
- Delete it — we remove it from our records and ask Keygen to do the same. Your licence keeps working; it was signed once and doesn't need us.
- Take it elsewhere — receive it in a machine-readable file.
- Object or restrict — tell us to stop or pause processing it.
Write to support@deepon.kr and we answer within 30 days, usually within two business days. If you think we've handled this badly, you can complain to your national data protection authority — in the EU and the EEA that's your local supervisory authority, in the UK the ICO, and in South Korea the Personal Information Protection Commission (privacy.go.kr, 118).
Where the data goes
Three companies see your email address, each for one job: Paddle (Ireland and the UK) takes the payment, Keygen (United States) issues the licence key, and Resend (United States) delivers the email. Transfers to the United States rest on the European Commission's Standard Contractual Clauses. Nobody else receives it, and it is never sold, rented or used for advertising.
Who is responsible
The data controller is Deep-On Inc., a company registered in the Republic of Korea. Our data protection officer under the Korean Personal Information Protection Act is the company representative, reachable at support@deepon.kr. Write in any language we publish this page in — English, Korean, Japanese, German, French or Spanish.
Questions
If something here is unclear or wrong, email support@deepon.kr or open an issue. We answer within two business days.