Privacy
What MacCrab Rave collects (and doesn't). On-device by default, public counters only, no per-user tracking.
MacCrab Rave follows the same posture as MacCrab itself: on-device by default, no account required, nothing phones home that doesn’t have to. This page is the honest account of what the catalog does and doesn’t collect.
Browsing the catalog
Browsing rave.maccrab.com and installing plugins needs no account and sets no tracking cookies. The catalog is static signed JSON; your MacCrab app fetches it, verifies the Ed25519 signatures against the key bundled in the app, and never reports back what you looked at or installed.
Popularity / install counts
Where you see a “downloads” count, it is derived entirely from public GitHub release download counters — the same number GitHub shows on a release page (downloads, not installs — we never learn whether a download became an install). We poll that public number on a schedule and store an aggregate. There is:
- no client-side telemetry — your MacCrab does not ping us when you install;
- no per-user, per-device, or per-IP record — only a single aggregate counter per plugin version;
- no signal at all for first-party plugins in this release — they ship from the catalog mirror, not GitHub releases, so they have no download counter to read.
Signing in (only for submitting / commenting)
You only authenticate — via GitHub OAuth — if you choose to submit a plugin or post a comment. In that case we store the minimum: your GitHub numeric id, login, and avatar URL, plus the submissions and moderation records tied to your account. We never store an email or any GitHub data beyond that. Admin access is a fixed allowlist of GitHub ids held in version control — there is no role you can be granted by using the site.
Comments
Comment threads are GitHub Discussions (via Giscus). The comment text and author identities live in GitHub, under GitHub’s privacy terms — not in our database. We keep only an optional count + thread link for display. Turning comments off changes nothing about the catalog or its trust chain.
Retention and deletion
If you signed in to submit or comment, you can delete your account. Deletion is a single atomic operation (POST /api/account/delete) that requires you to type your own login to confirm. We do not hard-delete every row — some data is anonymized, and one identifier is retained with justification, because parts of the catalog are an append-only accountability log and others are Ed25519-signed bytes we cannot rewrite from a web request. We are honest about that here rather than claiming a clean wipe.
Per-table, what happens on deletion:
| Data | On deletion |
|---|---|
Your user row (users) | Pseudonymized, not fully anonymized. login, avatar_url, the reputation snapshot, and any ban_reason are scrubbed; trust_state is set to deleted. Your GitHub numeric id is retained — see the justification below. |
Your submissions (submissions) | The denormalized submitter login is scrubbed to [deleted]. Any open / in-flight submission is withdrawn. Submissions that already reached a published/terminal state are left in place (their byline may be in signed catalog bytes — see the limit below). The submitter id link is retained. |
Media you uploaded (media) | Free-text captions are erased. Approved/published screenshot bytes that are part of a live listing are kept; the uploader link points only at your now-pseudonymized row. |
Reports you filed (reports) | Your reporter identity is anonymized, but the report body is kept — a resolved safety/abuse report must remain legible for anti-abuse purposes. |
Moderation log (moderation_events) | Free-text mentions of your login in your own log rows are redacted. The actor id is retained (audit anchor, below). A single terminal account_deleted marker row is written as proof of erasure. |
Why we retain your GitHub numeric id. Your github_id is the foreign-key anchor for the submission, moderation, media and report rows above, and it is the only stable handle that lets us enforce a ban or trace abuse if a bad actor deletes and re-creates. We keep it under legitimate interest (audit / anti-abuse), not under your consent, and the row it belongs to is otherwise pseudonymized. This is why we describe the result as pseudonymized-with-justified-retention, not “fully anonymized”.
Published-author limit (partial erasure). If a submission of yours was already merged into the signed catalog, your byline may be baked into bytes that are protected by an Ed25519 signature. We cannot rewrite signed bytes from this endpoint. On explicit request, we can enqueue an offline re-sign of the catalog to drop the byline.
Retention. The pseudonymized rows and the retained github_id anchor are kept only as long as needed for audit and anti-abuse (legitimate interest), and are minimized and removed once that need lapses.
What we never have
- Your installs, scans, or any forensic output — that stays on your Mac.
- The catalog signing key — it is offline and never touches this site’s servers.
- Any cross-site tracker, ad network, or analytics-by-default.
Security disclosure
Found a problem with a plugin or the catalog? Email maccrab@peterhanily.com. Don’t post security issues in a public comment thread. See the verification docs for the trust model.