Privacy Policy

Cyclone Fortress is a privacy and security tool, so privacy is the whole point. It is built local-first: the work it does — wiping, scanning, cleaning, encryption and recovery — all happens on your Mac. The overwhelming majority of what Cyclone Fortress touches never leaves your device. This page explains exactly what stays local, the few things that are sent over the network and why, and the choices you have.

What never leaves your Mac

Cyclone Fortress does not upload your files, your file lists or your activity unless you ask it to. Apart from what is listed under “The only data that is sent over the network” below, none of the following is ever collected, synced or transmitted:

• The contents of any file you erase, shred, scan, recover or inspect.
• Lists of your files, folders, drives, apps or installed software.
• Your full scan results — duplicates, large files, disk maps and privacy findings stay on your Mac. The one exception is the AI macOS Scan's written analysis, which sends a text summary of that scan's findings (described below); you can switch it off.
• Your clipboard, browsing history, caches or other system traces.
• Vault contents and vault passwords (see below).
• Your Activity History (see below).

Cyclone Fortress has no analytics that profile you and none that capture your clipboard, history or file contents. We do not sell data, run ad targeting, or share your activity with data brokers — ever.

Encrypted vaults & passwords

Vault and drive encryption happens entirely on your Mac. Vault passwords are held only in volatile, encrypted memory for the duration of your session and are erased when the app closes — they are never written to disk or sent anywhere. We do not hold your keys and cannot open your vaults.

The one opt-in exception: if you turn on Touch ID unlock for a Folder Vault, its password is kept in your Mac's login keychain, on that Mac only.

Activity History

Cyclone Fortress can keep an optional, on-device log of operations it has performed. It is disabled by default and opt-in. When enabled, it is encrypted at rest with a key bound to your Mac's hardware, stored only on your machine, and can be securely wiped at any time. Activity History is never uploaded, synced or sent to any server.

The only data that is sent over the network

A small number of optional, clearly-purposed network calls exist. Calls to our servers use certificate-pinned HTTPS. File content and personal data are sent only where an item below says so:

• Signature updates. Cyclone Fortress downloads updated malware-detection signatures. This is a download; nothing about your system is sent to receive it.
• Threat lookups. Deep Scan and Antivirus Check send file fingerprints (hashes, never contents) to our server to check them against known threats.
• License validation. Your license key and a device identifier are used to confirm your license is valid (once within 72 hours of a new activation, then roughly every 45 days). License keys are also verified on-device, so the app keeps working offline between those checks.
• Your license email. If you buy on this website, we receive from the payment processor the email address you paid with, and we store it with your license so we can send you your key and, if you ask, send it again. If you subscribe in the iPhone or iPad app instead, Apple tells us nothing about you — so we hold no address for you at all unless you choose to add one in the app to have your key emailed. When you do, we send a link to confirm the address before we send the key, so a mistyped address can never receive someone else's license. Either way the address is used only to deliver your key and to tell you about the license itself, such as when it is due to expire. It is never used for marketing — our product-news list is a separate sign-up you opt into yourself. We keep it for as long as the license exists, and you can have it deleted at any time by emailing support@cyclonefortress.com.
• Usage analytics. Aggregate event counts that contain no file contents or file lists. After a malware scan, the app also reports anonymous scan statistics — how many threats were found at each severity, how long the scan took, which detection engines were active, and the app and macOS versions — never file names or paths. Direct-download installs include a one-way hardware hash (never the raw identifier) so installs can be counted without profiling you. The app's offline switch turns analytics off along with every other feature that reaches the internet.
• Software update checks. A check for a newer version; no personal data is sent.
• AI features. If you use the built-in AI — Cyclone Help or the Cyclone AI Agent — the message you type is sent to our own privately-owned servers to generate a reply. The AI macOS Scan's written analysis and the AI File Explainer also send short text summaries. See “AI features” below for exactly what each one sends.
• Dark Web Monitor. When you check an email address, it is sent over an encrypted connection to our server, which looks it up in a specialist breach-data service we subscribe to and returns the result. If you turn on the weekly re-check, the addresses you monitor are sent the same way once a week. Our server does not store or log the address. Results are kept encrypted on your device. If you ask for the report by email, our server sends it to the email address registered with your license. Password checks never send your password: only the first five characters of a one-way hash leave your device, and the comparison happens on the device itself.
• Support requests. Only if you contact us — your message, the email address you provide and, from the app, details it adds: your Cyclone and macOS versions, Mac model, how Cyclone was installed, whether it has Full Disk Access, your license status and ID, a one-way hardware hash and your last Self-Check report.
• Launch notifications (website only). If you sign up on our website to be told when Cyclone Fortress is publicly released, we store the email address you enter and use it solely for that announcement. It is never shared or used for marketing lists, and you can have it deleted at any time by emailing support@cyclonefortress.com.
• Public network checks. The speed test, the public IP lookup and a DNS cross-check contact public internet services, which see your IP address.
• Optional cloud malware intelligence. Off unless you enable it and supply your own API keys. When used, file hashes may be checked against third-party threat feeds. Quick Scan uses no cloud layer at all.

AI features

Cyclone Fortress's AI runs on our own privately-owned servers. Nothing is sent to any third-party AI service (such as OpenAI or Anthropic), and there is no on-device telemetry of your questions. The AI comes in two parts: Cyclone Help, which only answers questions about Cyclone Fortress and how it works, and the Cyclone AI Agent, which can run tasks on your Mac but always asks your approval before making any change. Messages sent to the AI are processed ephemerally to produce a reply and are not stored. Cyclone Help answers from a general knowledge base about Cyclone Fortress and your question, plus any panel readings you attach. The Agent also receives what its tools report, which can include file names, paths or lines from a file it read, and AI Pic Diagnostics sends a resized copy of the picture you choose. Two other AI helpers do send limited data by design. The AI File Explainer sends the shape of one file path with your account name removed. The AI macOS Scan runs every scanner on your Mac; when the server connection is on (and Cyclone Fortressis not in Limited Mode), it then sends a text summary of that scan's results so an AI model on our own servers can write the analysis: scores and counts, the names and file paths of any threats found (with your account name removed), the labels of background items such as launch agents, high-risk app permission grants, open network “doors”, battery condition and uptime, and the names of pending software updates — never file contents. Before sending, your names, your Mac's name and your current Wi-Fi name are removed. With the server connection off, the scan still runs and Cyclone Fortress's built-in rules write the analysis on your Mac, with no AI model involved. Every scan report states which of these produced it. Both helpers go only to our own servers, identified by the same one-way hardware hash used to keep each machine's usage within its limits.

Payments

Purchases are handled by a third-party payment processor. Cyclone Fortress never sees or stores your full card details. We retain only what is needed to issue and validate your license.

Your choices

• Use the app's offline switch to turn off analytics — along with every other feature that reaches the internet — in one tap.
• Leave Activity History disabled (its default), or securely wipe it.
• Use Quick Scan to avoid any cloud lookups; leave cloud malware intel off.
• Uninstalling Cyclone Fortress removes its local data from your Mac.
• Request deletion of any support correspondence at any time.

Contact

Questions about this policy, or a data request? Reach us at support@cyclonefortress.com or via the support page.