Plain words about your data

The app

Clicker runs on your computer and talks to one server: clicker.x4ops.com for the trial and the license. It has no account and no sign in and no telemetry. It does not check for updates on its own.

The app contacts clicker.x4ops.com in four moments and sends these fields and nothing else. When the trial starts and about once a day during the trial: a hash of the machine and the trial start date and the app version. At activation: the key you typed and a hash of the machine and the app version. About once a day while licensed: a hash of the key and a hash of the machine and the app version. When you click Remove license: a hash of the key and a hash of the machine so the server frees the seat. Every call also carries the protocol version (the number 1) and the trial and activation and check calls carry a random request number (a nonce) that the signed reply echoes so the app can match the reply to its request. Every request also carries the app version in its User-Agent header (Clicker/2.2.0 for this release) so the Remove license call carries the version that way too. Like every web server clicker.x4ops.com sees the internet address your computer connects from. The license routes keep that address in memory for 10 minutes to limit the number of requests per address and Vercel (the hosting platform) keeps it in the standard request logs of its platform. No license record stores it. No name and no email and no file content and no settings and no macro ever leave the computer. The machine hash is derived from a hardware identifier and cannot be turned back into it. The server keeps the hashes and the first trial start it saw for a machine and the purchase email in hashed form so a lost key can be sent again. The License and subscription guide describes the trial and the key in full.

Everything Clicker saves lives in two folders on your computer. ~/.config/clicker holds last.json with your settings and the profiles and macros folders with the files you name and the backups folder and the log file clicker.log that rotates at 1 MB with 3 backups. Set CLICKER_CONFIG_DIR to use another root. The trial record trial.json and the license file license.json (and releases.json while a removed license still owes its seat release) live in ~/Library/Application Support/dev.zghanem.clicker on macOS and in %LOCALAPPDATA%\x4ops\Clicker on Windows and CLICKER_LICENSE_DIR moves them.

A recorded macro holds what you did while recording. That includes typed keys stored as plain text. Treat a macro file like a note you wrote yourself and do not record passwords.

The three macOS permissions (Accessibility and Input Monitoring and Screen Recording) let Clicker post clicks and keystrokes and record input and read the screen for image detection. Clicker uses them for those features alone and keeps nothing it sees except what you save as a macro or a template.

This website

This site is pages served by Vercel. The Clicker app calls the license routes under /api/license for the trial and the license and this site forwards them to the x4ops license service at license.x4ops.com which runs on Vercel. It sets no cookies of its own and runs no analytics and loads no third party scripts. Vercel keeps the standard request logs of its platform for the pages and the downloads and the license requests. The license service keeps the connecting address in memory for 10 minutes to limit the number of requests per address.

The Buy button opens a form while the checkout is not live yet. An email you enter there is forwarded once to x4ops and is not stored on this site. When the checkout opens the Buy button leads to a payment provider page and that provider handles your payment data under its own terms. After a payment the provider tells x4ops the order id and the email address of the buyer. x4ops creates the license key and emails it to that address and stores the order id and a hash of the address and never the address itself.

Contact

Questions go to support@x4ops.com.