Privacy

Last updated 26 September 2026

Dumi collects nothing. There is no account, no analytics, no crash reporting, and no advertising. Your tasks never leave your Mac. The app makes exactly two kinds of network request, both described below: a daily check for a newer version, and — only if you buy Dumi — the activation of your licence key.

What the app stores, and where

Your lists, tasks, focus sessions and bonsai progress live in a single file on your Mac:

• ~/Library/Application Support/Dumi/data.json

Two small files sit beside it: app.json, the last answer to the version check, and — once you've activated a key — license.json, which holds that key.

None of it is sent anywhere. Deleting that folder deletes everything Dumi knows. Your data may also appear in your own backups (Time Machine, iCloud Drive and the like) — that is between you and the backup you chose.

What the app sends

• The version check. At launch and once a day, Dumi fetches https://dumitasks.com/app.json — the newest version number and the current price. It is a plain request: no identifier, nothing about your tasks or your Mac. Like any web request, it shows this site's server your IP address (see Hosting below).
• Activating a key. When you paste a licence key and press Activate, Dumi sends that key and your Mac's name (the one in System Settings → General → Sharing, used as the label of the activation) to Creem, the payment provider, and stores the answer. This happens once per Mac, and never if you don't buy.

Buying Dumi

Payment is handled by Creem, who act as the merchant of record: the checkout runs on their site, and they receive your name, email, payment details and billing country. Dumi's author sees your name, email, country and the order — never your card — and uses them only for receipts, licence questions and refunds.

Permissions

Dumi asks for no system permissions. It does not read other apps' data, your calendar, your contacts, your files, your microphone or your camera. "Launch at login", if you switch it on, is handled by macOS itself.

This website

The site is static. It sets no cookies, runs no analytics and has no tracking pixels. Two things still involve someone else:

• Fonts. Typefaces are loaded from Google Fonts, so Google receives your IP address when the page loads. The fonts can be self-hosted instead — say the word.
• Hosting. This site's server keeps ordinary access logs — which page was asked for, when, from which IP address, with which browser — for thirty days at most. They are the only measure of how many people visit and download; there is nothing else. When the Buy button is pressed the page sends the server one empty request so that the log can note it, since the checkout itself happens on Creem's site.

Children

Dumi is not directed at children and collects nothing from anyone, of any age.

Changes

21 September 2026: version 1.1 added the daily version check and licence activation described above. If this changes again — for example, if an optional sync with another service is added — this page will say so before the feature ships, and any such sync will be opt-in.

Contact

Questions: contact@dumitasks.com