Privacy Policy

The Short Version

Your data stays on your computer. Whether you use the Mac app or the browser version at getexhibita.com/app, your call history, messages, and case data are processed locally and never uploaded to any server. We don't have access to your data and couldn't read it even if we wanted to. The only things we ever hold are what a purchase requires — your email address and license key — plus, if you ask us to email you the link, that address and the dates we mailed it, until you unsubscribe.

Desktop Application

• Data access:Exhibit A reads your Mac's CallHistory.db and iMessage chat.db databases locally. This requires Full Disk Access, which you grant through System Settings.
• Data storage: All data is stored locally on your Mac in ~/Library/Application Support/Exhibit A/. Nothing is uploaded to any server.
• Network requests:The only network request the app makes is to validate your license key with our own server at getexhibita.com over HTTPS. Only the license key is sent — never your call history or messages.
• No telemetry: Analytics are off by default and opt-in only. Unless you turn them on, zero data is sent to us or any third party.

Web App (getexhibita.com/app)

• Everything runs in your browser.When you open an iPhone backup, Exhibit A reads it entirely on your own computer using in-browser code (WebAssembly). Your calls and messages are never uploaded— there is no account and no server that receives them. You can disconnect from the internet after the page loads and it still works.
• Your backup password:If the backup is encrypted, Exhibit A asks for the password you set for “Encrypt local backup” in iTunes, the Apple Devices app, or Finder. It is used only to unlock that backup in this browser tab, for that one import. It is never stored, never written to your browser's storage, never logged, and never sent to us or to anyone else — closing or reloading the tab discards it.
• Data storage:Your parsed exhibit is kept only in your browser's local storage on this device, so you can come back to it. Clearing your browser data removes it.
• Network requests:Beyond loading the app itself, the browser app talks to our server only to validate a license key you enter, to open Stripe checkout if you choose to buy, to send the step counters described next, and — only if you ask for the backup steps by email — to send that email address so we can mail them to you. Your calls and messages are never part of any request.
• Step counters:So we can see where people get stuck, the browser app sends content-free counters to our server — one each when the app is opened, the sample exhibit is loaded, the backup instructions are opened, you ask for those instructions by email (the counter records only that you did — your address travels with the email request itself, never with a counter), the folder picker is opened, the folder picker is closed without choosing a folder, your browser refuses to open a folder you chose, a chosen folder does or doesn't contain a backup, an encrypted backup asks for its password, a password doesn't unlock the backup, a backup is parsed, an import fails, an import brings in messages but no call history, export is clicked, an upgrade prompt is shown, checkout is started, and a license is activated — tagged only with where you arrived from (for example an email link or the download page). Each counter is a single event name; it carries no contact names, phone numbers, message content, call counts, file names, folder names, device names, backup passwords, email address, or license key, and we can't tie it back to you. Each counter records the step name, where you arrived from, the app version, and — from the network request itself, as with any web page — your country and region and the time.
• Why an import failed:The failed-import counter carries one extra word, so we can tell a wrong password from a backup we can't read. That word is always one of six fixed codes we wrote ourselves — password_required, bad_password, no_data, unsupported, incomplete, or unknown — and never an error message, never anything read out of your backup, and never anything you typed. Our server checks the word against that same list and records anything else as unknown. Counting a wrong password does not send us the password, or any part of it.

This Website

• Analytics: We use Vercel Analytics and Speed Insights to measure page views and performance. These tools are privacy-focused, do not use cookies, and do not collect personally identifiable information (PII). They are GDPR-compliant.
• Download tracking: We track download button clicks (which button was clicked) to understand how visitors interact with the site. No personal information is collected.
• “Email me the link” and “Email me these steps”: If you ask us to email you the link for your computer, or ask the browser app to email you the iPhone backup steps, we store that email address, the time you asked, and which page or screen you asked from, so we can send what you asked for and up to three short follow-ups over the next twelve days. We also record which of those emails went out, so you never get one twice. Nothing else about you is stored, the list is never sold or shared, and leads older than 30 days get nothing further. Every message carries a one-click unsubscribe; once you use it, the address is added to a suppression list and we stop emailing it. Purchase receipts and license-key emails are separate and still arrive.
• No cookies: This website does not use cookies.

Third-Party Services

• Vercel: Website hosting and analytics (Vercel Privacy Policy)
• Stripe: Payment processing at checkout. Card details go directly to Stripe; we never see or store them (Stripe Privacy Policy)
• Resend: Sends your license-key email after purchase, and the link email and its follow-ups if you asked for them (Resend Privacy Policy)
• Upstash:Stores license records (your email address, license key, and plan) so your key can be validated, and — if you asked us to email you the link — your email address, which follow-ups were sent, and whether you unsubscribed. Nothing about your calls or messages is ever stored there (Upstash Privacy Policy)
• GitHub: Application distribution via GitHub Releases (GitHub Privacy Statement)

Contact

Questions about this policy? Email us at support@getexhibita.com. See also our Terms of Service.