Legal

Privacy policy

Last updated: October 31, 2026

NotchBar is a Windows desktop app made by one person — Arnav Sawant, not a company. This page explains, as plainly as possible, what the app and this website do with your data: what stays on your device, what gets sent elsewhere, and to whom.

This describes what the code actually does, not a generic template. Where something is uncertain, it says so rather than promising a legal guarantee it can’t back up.

The short version

  • Most of what NotchBar does — clipboard history, system stats, FileDrop, the Claude Code integration, the Usage Meter, local logs — never leaves your device.
  • To activate your license and check for app updates, NotchBar talks to Dodo Payments and GitHub.
  • Optional widgets you choose to add — Weather, Finance, Album art, GitHub Contributions, Calendar — talk to the outside services each of those needs, and only when you use them.
  • This website separately uses Supabase (where the update-notification signup, accounts, download records, free-copy claims and support messages are stored), Dodo Payments (for checkout), Cloudflare (it hosts the site and runs the bot check on our forms), and GitHub (GitHub Releases serves the installer, so it sees the IP address of whoever downloads it), and Google (sign-in only). These five are the only processors of your data on this site.

1. What stays on your device

The following happen entirely on your PC. NotchBar doesn’t transmit any of it anywhere:

  • Now-playing info — track title, artist, and artwork read from Windows’ own System Media Transport Controls (SMTC), used to render the music module.
  • Clipboard history — copied text is kept in local app storage so you can browse past clips; copied images are shown but not persisted across restarts. None of it is sent anywhere.
  • Notifications — only if you turn on notification mirroring, and only after you allow it in the Windows permission prompt. NotchBar reads the notifications Windows shows so it can display them in the notch. They’re held in memory while shown, not saved, and never sent anywhere.
  • System stats — CPU, memory, and battery info read from Windows via local OS APIs, for the System and Battery widgets.
  • Your settings — widget layout, toggles, tokens, and preferences, stored in the app’s own local data on your device.
  • Local logs — the app writes an activity log to a local log file for troubleshooting. It is never uploaded or transmitted.

2. What NotchBar sends over the network, and to whom

Each item below is one flow: what leaves your device, where it goes, and when it happens. “Always” means it’s required for the app to function (license enforcement); everything else only happens if you add that widget, enter that data, or turn on that setting.

License activation & validation

Always

To run, NotchBar needs a valid license. When you activate, it sends your license key and your Windows computer’s hostname (e.g. “DESKTOP-A1B2C3 (Windows)”) to Dodo Payments, which is who NotchBar is sold through. Dodo returns an activation ID, which is cached locally so you’re not re-entering your key on every launch. NotchBar re-checks your license with Dodo each time it starts and periodically while it runs; if it can’t reach Dodo, it keeps trusting a previously-valid license for up to 14 days before requiring a successful check.

Dodo Payments is also the Merchant of Record for your purchase — see Dodo Payments’ privacy policy for how they handle this data.

Update checks

When you click Check for Updates

The About tab lets you check for a newer version. That request fetches a small version-manifest file from NotchBar’s GitHub Releases page and, if you choose to install, downloads the update package from there too. No account or personal data is included in this request. See GitHub’s Privacy Statement.

Album art & artist photos

When the Music widget shows a track

When Windows doesn’t supply embedded album art for what’s playing, NotchBar sends the song title and artist name to Apple’s iTunes Search API to find cover art. Artist photos are looked up the same way (artist name only); if Apple has none, the artist name is sent to Deezer as a fallback.

Weather

Only if you add the Weather widget

Your coordinates — either from a Windows location permission prompt or typed in manually — are sent to Open-Meteo to fetch a forecast. If you use the “detect location” button, those same coordinates are also sent to OpenStreetMap’s Nominatim service once, to resolve a city name for display.

Finance ticker

Only if you add symbols to the Finance widget

The stock/ticker symbols you add (up to 5) are sent to Yahoo Finance to fetch quotes and price history. See Yahoo’s Privacy Policy.

GitHub integration

Only if you connect GitHub or enter a username

Connecting an account uses GitHub’s own OAuth device flow: NotchBar exchanges codes directly with GitHub and receives an access token, which is stored locally on your device (in the app’s own local settings data).

The Contributions widget sends your GitHub username (and access token, if connected) to GitHub’s API to fetch your contribution calendar. If you haven’t connected an account, it instead sends just your username to a third-party public proxy, github-contributions-api.jogruber.de — we don’t have a published privacy policy for that service to link to.

If a token is connected, the CI-status pill polls GitHub’s API every 30 seconds with your username and token to check for recent workflow runs. See GitHub’s Privacy Statement.

Calendar sync

Only if you add an iCal feed

The calendar feed URL you paste in (from Google Calendar, Outlook, Apple Calendar, or elsewhere) is fetched directly by NotchBar to read your events. Only public http/https URLs are allowed — NotchBar blocks feed URLs that point at localhost or private network addresses. Whatever data that feed contains goes to whichever provider issued the URL, under that provider’s own privacy policy, not NotchBar’s.

FileDrop

Only while a transfer is active

Files you choose to share are served from a temporary local web server on your PC, reachable only on your local Wi-Fi/LAN network, protected by a random one-time access code embedded in a QR code. Nothing is sent to NotchBar or any third party — the transfer happens directly between your devices on your own network.

Claude Code integration

Only if enabled in settings

This runs a small local server on your device (127.0.0.1:7422) that Claude Code’s hooks and statusline post tool-activity data to, so NotchBar can show it in the notch. That traffic stays on your device — the server only accepts requests that look like they came from localhost and rejects everything else. Turning this on adds entries to your local ~/.claude/settings.json (Claude Code’s own config file) so it knows to post to that local server; turning it off removes them again.

Usage Meter

Only if enabled

Reads Claude Code’s statusline data (via the same local loopback flow above) and Codex’s local session files (~/.codex/sessions/*.jsonl) directly from disk to show usage/rate-limit numbers. Nothing here leaves your device.

3. What this website collects

  • Update-notification signup. The “Stay in the loop” form on this site collects the name and email you submit and stores them in a Supabase database, together with your country and the launch-link label described below, used only to email you about major updates and new widgets. The form is protected by Cloudflare Turnstile. See Supabase’s Privacy Policy for how Supabase handles data on its infrastructure.
  • Sign-in with Google and your account. Downloading or buying needs an account. You sign in with Google, which tells us your name, email address and Google account ID; we never see your Google password. On the next page you give us your phone number (we don’t verify it) and agree to how we use your details. We store these in our Supabase database together with your approximate location (city, region and country, worked out by Cloudflare from your IP address), your browser’s user-agent, the launch-link label if you arrived through one, and when you sign in and download. We use them to give you NotchBar and your licence, to help you when you ask for support, to contact you about a payment or a chargeback, and to count downloads to understand how NotchBar is used. We don’t sell your data or use it for ads. If you tick the optional box we also email you about NotchBar updates. If you buy, we pre-fill your email on Dodo’s checkout page. You can withdraw your consent at any time by deleting your account on the Account page; that deletes these details. For complaints you can write to arnavsawant.ai@gmail.com or to the Data Protection Board of India. Google handles the sign-in under Google’s Privacy Policy.
  • Support messages. If you use the form on the support page, we store your name, email, the message, the topic, the NotchBar version if you give it, and your country, in our Supabase database, so I can reply and keep track of open problems. Emailing arnavsawant.ai@gmail.com instead sends your message through your own email provider.
  • Checkout. Clicking “Buy” redirects you to Dodo Payments’ own hosted checkout page. Dodo is the Merchant of Record for this purchase and processes your payment details — this website never receives or stores your card information. After a successful payment, Dodo emails you a license key directly.
  • Free copies. The first 50 people who sign in and click Download get their own licence key. For that we also keep a one-way hash of your IP address (never the address itself), in our Supabase database, to give one key per person and to stop abuse. The key itself is created in Dodo Payments under your email, and comes to you as a text file in your browser; we don’t email it. Free keys work on one PC: we check which PC name activated the key, and a key that later appears on a different PC is switched off. The request is protected by Cloudflare Turnstile, which checks it comes from a real browser. A one-way fingerprint of your Google account and of your network is kept on a claimed free key, so the same person can’t claim twice, even after deleting an account.
  • Hosting. This site runs on Cloudflare, which processes your IP address to deliver pages and protect the site. It may use Cloudflare Web Analytics, which counts page views without cookies and without following you across other sites. It also uses Google Analytics to count visits and see which pages and links work. It runs on the public pages only, never on sign-in, account or admin pages, and only the page address (without anything after the “?” except campaign tags that start with utm_) is sent. No name, email or account ID is sent, and advertising features are off. If your browser is in a European time zone, or it sends a Do Not Track or Global Privacy Control signal, Google Analytics starts switched off and sets no cookies until you press Allow in the small banner; your choice is kept in your browser. If you arrive through a launch link (one ending in ?ref=…), that short label is kept in your browser for 30 days and attached to your purchase, so we can see which channels work; it contains nothing about you. See Cloudflare’s Privacy Policy.
  • Cookies. This site sets two cookies of its own, both only for signing in. Google Analytics, when it is switched on, adds its own _ga cookies (up to about two years) and we keep your analytics choice under nb_analytics in your browser’s local storage. nb_oauth lasts ten minutes while you are on Google’s sign-in page. __Host-nb_session lasts 90 days; it holds a random account ID and a signature (no name or email) so we know you are signed in, and is sent only to this site. Signing out or deleting your account removes it. We can’t make claims beyond that about what our hosting or infrastructure providers (Cloudflare, Supabase, Google) do under the hood — see their respective policies linked above.

4. Data retention

  • Your license key and activation ID are cached in a local file on your device until you deactivate the license or uninstall the app. Dodo Payments retains what it processes under its own policy.
  • Accounts, waitlist signups, download records and support messages are kept for 24 months after your last activity (your last sign-in, download or message, or when you joined the list), then deleted. You can ask us to delete yours earlier: email arnavsawant.ai@gmail.com and we delete it on request.
  • A free-copy claim is kept for as long as its key exists, so the one-key-per-person rule still holds, and is deleted when you ask. Deleting your account also switches your free key off. Dodo Payments keeps its own customer and payment records as Merchant of Record, under its own policy.
  • GitHub tokens, clipboard history, calendar feed URLs, and other settings are stored locally on your device only, for as long as the app is installed or until you clear/disconnect them in Settings.
  • Local logs live in a log file on your device until they’re overwritten or you delete them yourself.
  • Standard Windows uninstall removes the installed program. Local data NotchBar wrote — settings, license cache, logs — is stored in your user profile’s app-data folder and may need to be deleted manually if you want it fully gone.

5. Your choices

Almost everything in section 2 is opt-in: it only happens if you add that widget, enter that data, or flip that toggle. You can:

  • Remove a widget to stop the network calls it makes.
  • Disconnect GitHub, or clear your clipboard history, at any time in Settings.
  • Remove a calendar feed at any time.
  • Turn off “Claude Code Activity” or the Usage Meter to remove the entries NotchBar added to ~/.claude/settings.json.
  • Deactivate your license from the About tab, or uninstall the app entirely, at any time.
  • Delete your account on the Account page at any time. That withdraws your consent and deletes your details (a free key you claimed stops working; what stays is a pseudonymous record of that key: its last 4 characters, the Dodo IDs and the one-way fingerprints, with no name or email). You can also turn the update emails on or off there.
  • Complain to us at arnavsawant.ai@gmail.com, or to the Data Protection Board of India.

6. Children

NotchBar and this website are not directed at children, and we don’t knowingly collect data from children.

7. Changes to this policy

If NotchBar adds a feature that changes what data it sends or where, this page will be updated and the “Last updated” date at the top will change accordingly.

8. Contact

Questions about this policy or your data: arnavsawant.ai@gmail.com.