AutoSync Privacy Policy
Effective date: 2026-06-10 Operator: Resona Frame CO., LTD., 12 F., No. 2, Guanqian Rd., Zhongzheng Dist., Taipei City 100007, Taiwan Contact: service@resonaframe.com
This Privacy Policy describes what personal data the AutoSync macOS application (the "App") and the autosync.resonaframe.com website (the "Site") handle, who has access to it, how long we keep it, and what rights you have under the EU General Data Protection Regulation (Regulation (EU) 2016/679), the UK Data Protection Act 2018, the California Consumer Privacy Act / California Privacy Rights Act, and Taiwan's Personal Data Protection Act (PDPA).
We follow a data-minimisation approach: we collect what we need to deliver and license the App, and we do not collect what we do not need. We do not maintain advertising profiles, behavioural analytics, or telemetry inside the App.
1. What AutoSync (the App) does on your Mac
The App runs entirely on your Mac. Specifically:
- Media files you drop into or open with the App are read from disk on your machine only. We do not upload, copy, mirror, or transmit any video, audio, or image content — not the files, not previews, not waveform extractions, not metadata derived from them. File names, paths, timecodes, durations, and audio waveforms stay on your Mac.
- Sync results and exported FCP7 XML are written only to disk locations you choose, on your Mac.
- In-memory caches (waveform envelopes, decoded metadata, alignment results) live for the duration of one App session unless you explicitly export them. The persistent waveform peak cache (
PeakCache) writes opaque binary.aspkfiles into the App's caches directory on your Mac; these files contain downsampled audio peak data only and never leave your Mac. - Local logs are written to a per-sync log folder when you run a sync. These contain file names, track names, alignment decisions, and timing values to help you (and us, if you choose to send them in) diagnose a problem. They stay on your Mac unless you choose to share them.
- Trial record. If you start a free trial of the App, two small timestamp records are written locally: one in
UserDefaultsand a sidecar file at~/Library/Application Support/AutoSync/.trial. They contain only the trial start timestamp and the most recent launch timestamp, and exist solely so the trial window cannot be silently reset by deleting one copy or by setting the system clock back. They contain no personal data and never leave your Mac.
The App is not connected to any analytics, telemetry, crash-reporting, advertising, or behavioural-tracking SDK. The only network calls the App makes are listed in Section 2.
2. What the App sends over the network
The App makes the following outbound HTTPS calls, and no others:
| When | Endpoint | What we send | Why |
|---|---|---|---|
| At activation, and on each scheduled re-verification (every 14 days) | api.gumroad.com/v2/licenses/verify (Gumroad, Inc.) |
License key, product identifier | To confirm your license is valid for this product |
| When you sign out of a Mac via AutoSync → 授權狀態… → 登出此機器 | autosync-license.weibing.workers.dev/decrement (our Cloudflare Worker) |
License key | To release the activation slot on Gumroad so it can be reused on another Mac you own |
| Periodically while the App is running, and when you tap "Check for Updates" | autosync.resonaframe.com/appcast.xml (our Cloudflare Pages site) |
Standard HTTP request headers (App version, macOS version, system language via User-Agent) |
To learn whether a newer version of the App is available |
| When an update is available and you choose to install it | autosync.resonaframe.com/downloads/... (Cloudflare R2-backed CDN) |
Standard HTTP request headers as above | To download the update binary |
If your Mac is offline when a scheduled re-verification is due, the App keeps working for an additional 7-day grace window — i.e. up to 21 days of continuous offline use between successful verifications. A single successful verification resets the cycle.
The license-verify call returns your buyer name and email address (which Gumroad already holds). The App caches these locally in UserDefaults so the License Info panel can display "Activated by …". This cached data does not leave your Mac after that point and is removed when you sign out.
The sign-out call sends only your license key to our Cloudflare Worker, which forwards a decrement_uses_count request to Gumroad on your behalf. The Worker keeps a short-lived rate-limit counter, keyed on the license key, that expires after one hour; it does not persist the call, the key, or any other detail beyond that window.
The update-feed and update-download requests are served by Cloudflare from Cloudflare's edge. Cloudflare may log standard HTTP request metadata (IP address, User-Agent, timestamp, URL, response status) for operational and security purposes per Cloudflare's own privacy policy.
The App does not send the in-app Sparkle anonymous system profile, does not auto-upload crash reports, and does not contain any analytics or telemetry SDK.
3. The support diagnostics bundle
When you choose Help → Build Support Bundle (or equivalent), the App writes a folder to your Desktop containing:
- a short text file with App version, macOS version, locale, and architecture;
- the past 24 hours of the App's local console log (
os_logentries for the AutoSync subsystem) — this includes file names and full paths of media you have worked with, track names, and sync diagnostics, but does not include the contents of any media file; - up to the five most recent AutoSync crash reports from your user-level diagnostic-reports directory (these include in-process state and call stacks captured at the moment of a crash).
The support bundle is not transmitted automatically. It is written to your Desktop and revealed in Finder; we receive it only if you choose to email it or attach it to a support ticket. You can review and redact the contents before sending. We treat any bundle you send us as support-correspondence data under Section 6.
4. What the Site (autosync.resonaframe.com) does
The Site is a static landing page hosted on Cloudflare Pages, backed by Cloudflare R2 for the App download artifacts.
When you visit the landing page, the Site loads Meta Pixel from connect.facebook.net using Pixel ID 2352431558903073. On page load, the Site sends a PageView event to Meta. When you click a trial-download CTA, the Site sends Lead and a custom AutoSyncTrialDownload event to Meta immediately before redirecting you to the publicly hosted AutoSync trial .dmg download URL. When you click a purchase CTA, the Site sends InitiateCheckout and a custom AutoSyncBuyClick event to Meta immediately before redirecting you to Gumroad checkout. When you switch the Site language between English and Traditional Chinese, the Site sends a custom LanguageSwitch event to Meta with the selected language code.
Those Pixel requests may disclose standard browser and request metadata to Meta, including your IP address, browser / device information, page URL, referrer, and the fact that you viewed the page, clicked a CTA, or switched the Site language. Depending on your browser and your relationship with Meta's services, Meta may also set or read its own cookies or similar storage in connection with these requests.
Separately, the Site stores one small first-party preference in your browser's localStorage: as_lang, which remembers whether you last viewed the page in English or Traditional Chinese. We use that value only to preserve your language preference on future visits.
Cloudflare may log standard HTTP request metadata (IP address, User-Agent, timestamp, URL, response status) at the edge for operational, security, and abuse-prevention purposes, per Cloudflare's own privacy policy at https://www.cloudflare.com/privacypolicy/.
5. What we process, and the legal basis under GDPR
| Category | Where it lives | Legal basis (GDPR Art. 6) | Retention |
|---|---|---|---|
| License key, buyer name, buyer email | The Macs on which you have activated the App; Gumroad's systems | Performance of a contract (Art. 6(1)(b)) — necessary to deliver and license the App | Until you request deletion of your account from Gumroad, or seven (7) years from the date of last purchase under Taiwan Commercial Accounting Act §38 record-keeping rules for registered companies, whichever is later |
| Order history, invoice records | Gumroad | Legal obligation (Art. 6(1)(c)) — tax record-keeping | Seven (7) years per Taiwan Commercial Accounting Act §38 |
| Support correspondence (emails to service@resonaframe.com) | Operator's email inbox | Legitimate interest (Art. 6(1)(f)) — to respond to your request | 3 years from the date of the last message in the thread |
Landing-page PageView, Lead, AutoSyncTrialDownload, InitiateCheckout, AutoSyncBuyClick, and LanguageSwitch events |
Meta's systems | Legitimate interest (Art. 6(1)(f)) — ad-performance measurement, trial-download attribution, checkout attribution, language-preference interaction measurement, and marketing effectiveness for the Site | Per Meta's own retention policy and your Meta account / browser state |
as_lang language preference |
Your browser localStorage |
Legitimate interest (Art. 6(1)(f)) — remember your chosen Site language | Until you clear browser storage or overwrite the value |
| Server-side rate-limit counter, keyed on license key | Cloudflare Workers KV (our License Worker) | Legitimate interest (Art. 6(1)(f)) — abuse prevention | 1 hour, then automatically expired |
| Cloudflare edge request logs (IP address, User-Agent, URL, timestamp) | Cloudflare's infrastructure | Legitimate interest (Art. 6(1)(f)) — operations, security, and abuse prevention | Per Cloudflare's standard log-retention period |
Other than the Site-side Meta Pixel described above, we do not engage in profiling or automated decision-making with legal effect, and we do not ship targeted-advertising or behavioural-tracking SDKs inside the App.
6. Sub-processors
The following third parties process data on our behalf or in connection with the App:
| Service | Purpose | Region | Privacy reference |
|---|---|---|---|
| Gumroad, Inc. | Payment processing, license-key issuance, customer email delivery for purchase receipts | USA | https://gumroad.com/privacy |
| Meta Platforms, Inc. | Advertising attribution and CTA / checkout measurement on the Site via Meta Pixel | USA | https://www.facebook.com/privacy/policy/ |
| Cloudflare, Inc. | Hosting (Pages + R2) for the Site, the appcast, and the App download artifacts; Workers + KV for the License Worker | USA | https://www.cloudflare.com/privacypolicy/ |
| Apple, Inc. | Software notarisation, Developer ID validation by your Mac's operating system | USA | https://www.apple.com/legal/privacy/ |
| Google LLC (Google Workspace) | Delivery and storage of email sent to service@resonaframe.com |
USA | https://workspace.google.com/terms/dpa_terms.html |
International transfers. Personal data may be transferred to the United States in the course of these sub-processing activities. The Republic of China (Taiwan) does not at the date of this policy hold an EU adequacy decision; for transfers from the EU/EEA, the UK, or Switzerland we rely on the applicable Standard Contractual Clauses (SCCs) as published or supplemented by these sub-processors and by the Operator, together with any supplementary measures reasonably necessary to maintain an equivalent level of protection.
We do not appoint sub-processors beyond those listed above without first updating this policy.
7. Your rights
If the GDPR, the UK DPA 2018, the California CCPA/CPRA, the Taiwan PDPA, or another comparable privacy law applies to you, you have, subject to that law's scope and exceptions, the right to:
- Access the personal data we hold about you and obtain a copy.
- Rectify inaccurate or incomplete data.
- Erase your data (the "right to be forgotten"), subject to our legal obligations to retain records (e.g. tax).
- Restrict or object to processing.
- Data portability — receive a copy of your data in a machine-readable format.
- Withdraw consent at any time where processing is based on consent (which, as at this effective date, does not apply to any processing we perform).
- Lodge a complaint with your local supervisory authority. In Taiwan, this is the National Development Council; in the EU, your member-state data-protection authority; in the UK, the Information Commissioner's Office; in California, the California Privacy Protection Agency.
To exercise any of these rights, email service@resonaframe.com. We aim to respond within 30 days. You may also deactivate your license on a specific Mac at any time via AutoSync → 授權狀態… → 登出此機器 without contacting us.
We have not appointed a formal Data Protection Officer; the Operator is a small organisation that does not meet the GDPR Art. 37 mandatory-appointment thresholds at this date. Privacy queries are handled directly by the Operator at the contact address above.
8. Children
The App is a professional editing tool not directed at children under the age of 16. We do not knowingly collect personal data from minors. If you believe we have inadvertently collected data from a minor, contact service@resonaframe.com and we will delete it.
9. Changes to this policy
We may update this Privacy Policy from time to time. Updates will be posted at autosync.resonaframe.com/privacy with a new effective date. For changes that materially expand what data we collect, who we share it with, or how long we retain it, we will additionally email registered customers at least thirty (30) days before the new effective date.
10. Contact
For privacy queries, deletion requests, or to exercise any of the rights in Section 7: service@resonaframe.com.