Privacy & legal

Effective date: 2 November 2026

This page covers the free web tool on openrar.app, the Mac app waitlist, the OpenRAR app for Mac, the licence server at api.openrar.app, and the purchase of OpenRAR Business licences.

Publisher

Yando Pte. Ltd., 68 Circular Road, #02-01, Singapore 049422 (UEN 202018750D). Contact: support@openrar.app.

Yando Pte. Ltd. is the controller of your personal data. For any privacy question or request, write to support@openrar.app. Singapore’s Personal Data Protection Act 2012 (PDPA) is our home law. When we serve people in the EU, the EEA or the UK, the GDPR and the UK GDPR also apply, and this policy is written to meet them.

The short version

• Your archives stay with you. The web tool opens them in your browser, and the Mac app opens them on your Mac. Their contents, file names and passwords are never sent to us or to anyone else.
• Analytics, no advertising. The website uses Google Analytics to measure visits, downloads and purchases, with Google’s advertising features turned off. You can turn its cookies off (see below). The website has no advertising and no ad pixels. The Mac app contains no analytics, no advertising and no crash reporting.
• The Mac app connects to us for two things only: to check for updates, if you leave update checks on, and for a Business licence (to activate one, to check it about once a month, and to deactivate it). Neither sends anything that identifies you.
• When you buy, Stripe handles the payment. We keep what we need to deliver your key, let you recover it, and keep accounting records. We store your licence key only as a hash.

The web tool: your files

OpenRAR opens archives with code that runs in your browser. The archive and the files inside it are never sent to us or anyone else.

The web tool: what we don’t do

No account and no advertising. The website’s only third-party script is Google Analytics, described below. It never sees your archives, their file names or their passwords.

The Mac app waitlist

If you ask to hear when OpenRAR for Mac is released, we keep your email address, the page you signed up on and the date, in a database at Cloudflare. We use it for one thing: a single email on release day. We don’t share it or add you to anything else. Write to support@openrar.app and we delete it; we also delete the whole list once the release email has gone out.

Counting downloads of the Mac app

When you download OpenRAR for Mac from openrar.app, our server counts the download. It records the time, the file, the country Cloudflare derives from your connection, where the download link was clicked (a page of openrar.app or the name of the site that linked to it), any utm_source and utm_campaign tags in that page’s address, and whether the request looks automated. This count records no IP address and sets no cookie. These counts, added up, appear in Yando’s internal dashboard.

Website analytics (Google Analytics)

To know how people find the site and which pages lead to downloads and purchases, openrar.app uses Google Analytics 4, a service of Google. It is loaded on openrar.app only.

• What it measures: the pages you view, the site that sent you and any campaign tags (utm_… and ad click identifiers) in the page’s address, your browser, device type, language and approximate location (country, region, city, derived by Google from your IP address, which Google Analytics does not store), clicks on the Mac app download, the start of a checkout (number of seats and price), and a completed purchase (amount, currency, seats, and a random-looking reference derived from the order). It also counts scrolling, clicks on links to other sites and use of forms (not what you type).
• What it never receives: your archives and anything about them, your email address, your name, your licence key, or your Stripe checkout session id: we remove every other parameter from the page address before Google sees it.
• No advertising: Google signals and ad personalisation are off, and advertising storage is refused for everyone, so the data is not used to show you ads or linked to your Google account.
• Cookies: Google Analytics sets the cookies _ga and _ga_Q1HNN6T0V8, which keep a random identifier for 13 months, so that repeat visits are recognised. You can turn them off for this site with this button; your choice is remembered in your browser for 13 months. Turn off analytics cookies
• Opting out: block cookies or scripts from google-analytics.com and googletagmanager.com in your browser or with a content blocker, or install Google’s opt-out add-on. The site works the same without it.

Google processes this data for us under the Google Ads Data Processing Terms. Google Analytics keeps it for at most 14 months.

Hosting

The site is served by Cloudflare, which processes your IP address and the pages you request to deliver the site and protect it from attacks, and keeps short-lived logs.

The Mac app: what stays on your Mac

• Archives and passwords. OpenRAR reads archives on your Mac, in a separate helper process. When an archive needs a password, it goes only to that local process. OpenRAR does not save it.
• Temporary files. Files you open or preview from an archive (with Open or Quick Look) are extracted to a temporary folder on your Mac. OpenRAR deletes them when it quits and when it starts.
• Settings. Your preferences, such as whether to reveal files after extraction, are stored in OpenRAR’s preferences on your Mac.
• Licence, if you activate one. Your licence key and the signed licence token are stored in the macOS Keychain. The token contains the licence id, the number of seats, the licensee name and your Mac’s device hash. The app keeps the key so that it can deactivate this Mac when you ask. The date of the last licence check is stored in OpenRAR’s preferences.

The Mac app: what it sends, and when

Update checks. When automatic update checks are on, as they are by default (you can turn them off in OpenRAR’s settings), the app downloads the list of available versions from openrar.app/appcast.xml about once a day, using Sparkle, the standard update framework for Mac apps. The request carries only what any download does: the app’s name and version in its user agent, and your IP address, seen by Cloudflare. It sends no identifier and no information about your Mac. Updates are downloaded from openrar.app and their signature is checked before they are installed. By default they install automatically; you can turn that off in the same settings and choose when to install.

Apart from update checks, the app makes network requests only to our licence server, api.openrar.app, and only in these three cases:

• You enter a licence key and click Activate. The app sends the licence key, a device hash and the name of your Mac, to check the key, record this Mac against the licence’s limit (3 Macs per seat), and get back a signed token.
• At launch, if a licence is active and more than 30 days have passed since the last successful check. The app sends the signed licence token, only to learn whether the licence has been refunded, suspended or revoked. If the Mac is offline, nothing happens and the licence stays.
• You click Deactivate on This Mac. The app sends the licence key and the device hash, to free this Mac’s place on the licence.

• The device hash is a SHA-256 digest of your Mac’s hardware identifier combined with a value specific to OpenRAR. We never receive the identifier itself, and the hash cannot be matched with identifiers used by other apps.
• The name of your Mac is the name set in System Settings › General › Sharing (for example “Jane’s MacBook Pro”), so it may contain your name. We keep it so that a Mac can be recognised when you ask us to free its place.
• Like any internet request, these requests reveal your IP address to Cloudflare, which runs our server (see “Abuse prevention and logs”).
• Links. Menu items and buttons such as “Buy a Licence…”, “openrar.app” and “Contact Support” open your web browser or email app. What happens next is covered by the website sections of this policy, or by your email provider.
• macOS itself may contact Apple about apps you run, for example to check that OpenRAR is notarized. That is governed by Apple’s privacy policy, and we receive none of it.

Buying a Business licence

Payment. You pay through Stripe Checkout, on checkout.stripe.com. Stripe collects:

• your email address;
• your name and billing address, which are required;
• your company name, if you enter one. It becomes the “licensee” shown in the app and in our emails;
• your payment details.

Card details are entered on Stripe’s systems and never reach us. Stripe processes the payment for us, and also uses data for its own legal and fraud-prevention purposes as an independent controller, under the Stripe Privacy Policy. Stripe also creates your invoice.

Campaign tags. If the buy link that took you to checkout contains campaign tags, our server passes them to Stripe with your order, so that a purchase can be linked to the campaign that brought it. These are UTM tags (utm_source, utm_medium, utm_campaign, utm_term, utm_content, utm_id), the ad click identifiers gclid, gbraid, wbraid, fbclid, msclkid, twclid and rdt_cid, and the campaign_id, ad_id and ref parameters. This uses no cookie and no script: only what is already in the link.

What our licence server keeps

• Account: your email address.
• Licence: a SHA-256 hash of your licence key (we cannot read the key back from it); the licence id, plan, number of seats and Mac limit; its status (for example active, refunded or revoked); the licensee name; the purchase date; and Stripe references (customer, payment and checkout session ids), used to match refunds.
• Activated Macs: for each Mac, the device hash, the Mac’s name, and the dates it was first and last seen. “Last seen” is updated at each monthly check.
• Replaced keys: if you ask for your key again, the hash of the old key, so that it can no longer activate new Macs.
• Thank-you page: your new key, encrypted (AES-GCM), so that the page can show it once. It is deleted as soon as it is shown, and can no longer be read after one hour.
• Stripe event ids, so that a payment is never processed twice. These contain no personal data.

Emails

• Licence emails are sent from licence@openrar.app through Cloudflare’s email service. There are two kinds: your key after a purchase, and a new key when you ask for one again, using the email address you give us. Replies go to our support mailbox.
• Receipts and invoices are created by Stripe, which may also email them to you.
• The waitlist email. If you joined the Mac app waitlist, you get one email on release day, as described in the waitlist section. That is the only announcement we send. We send no newsletters or other marketing emails.

Abuse prevention and logs

• Rate limiting. To protect the licence server, Cloudflare limits how many requests each IP address can make per minute. This limit is held by Cloudflare and is not stored in our database.
• Counters. For key recovery and the thank-you page, our database also keeps hourly counters. They hold only a hash of your IP address, never the address itself, and for key recovery a SHA-256 hash of the email address. They are deleted after 24 hours.
• Server logs. Cloudflare keeps logs of requests to our server, including IP addresses, for up to 7 days. Our own log lines are written to exclude licence keys and email addresses.

Why we use this data, and on what legal basis

• Performing our contract with you: selling and delivering the licence, activating it, checking it, freeing Macs, recovering keys, handling refunds, answering support requests.
• Legal obligations: tax and accounting records.
• Legitimate interests: preventing fraud, key sharing and attacks; knowing which campaigns bring purchases (see “Campaign tags”); and measuring how the website is used (see “Website analytics”).

Under the PDPA, we collect, use and disclose personal data only for these purposes, which this policy notifies to you, with your consent or where the PDPA otherwise permits.

How long we keep it

• Account and licence records: for as long as the licence exists. A licence is perpetual, so this is until you ask us to delete it. Purchase records are also kept for 5 years for accounting, as the law requires.
• Activated Macs: until you deactivate the Mac, or the licence record is deleted.
• Refunded licences: the records of their activated Macs are deleted 90 days after the refund. The purchase records are kept for accounting, as above.
• Replaced key hashes: as long as the licence record.
• Thank-you page key: until shown, at most one hour.
• Mac app waitlist (email, signup page, date): until the release-day email has gone out, then the whole list is deleted; earlier on request.
• Google Analytics: at most 14 months; its cookies, where set, 13 months.
• Rate-limit counters: 24 hours.
• Cloudflare request logs: up to 7 days.
• Stripe data: under Stripe’s retention rules and our accounting obligations.
• Support emails: 3 years after the last message.

Who processes it for us

• Cloudflare, Inc. hosts the website, the waitlist database and the licence server (with its database, rate limiting and request logs), and sends licence emails.
• Stripe handles payments, invoices and receipts.
• Google (Google LLC, and Google Ireland Limited for visitors in Europe) provides website analytics.
• Our email provider hosts the mailbox that receives your messages to support@openrar.app and your replies to licence emails.

We share personal data only with these providers, under contract. We may also disclose it where the law requires, or to a successor if the OpenRAR business is transferred, under the same commitments. We do not sell or rent personal data.

International transfers

We are based in Singapore, and our providers operate worldwide, including in the United States. When personal data leaves the EU/EEA, the UK or Singapore, we rely on adequacy decisions or on the standard contractual clauses in our providers’ data processing terms, and on comparable protection as the PDPA requires.

Your rights

Depending on where you live, you can ask to access, correct, delete or export your personal data, or to restrict or object to its use. Write to support@openrar.app from the email address used for the order, so that we can confirm it’s you. We answer within 30 days.

If we delete your licence record, we can no longer recover your key or free Macs on it. Macs that are already activated keep their licence, because the app checks it on the Mac itself. Keep your invoice as proof of purchase.

You may also complain to a supervisory authority:

• in Singapore, the Personal Data Protection Commission (PDPC);
• in the EU/EEA, the authority of your country;
• in the UK, the Information Commissioner’s Office (ICO).

Security

• All traffic is encrypted (HTTPS).
• Licence keys are stored on our server only as SHA-256 hashes.
• Licence tokens are signed (Ed25519), and the app checks them on your Mac.
• The thank-you page key is encrypted and short-lived.
• The device hash never contains your Mac’s hardware identifier.
• Access to production systems is limited to the people who need it.

If a breach affecting your data occurs, we will notify you and the authorities as the law requires.

Children

OpenRAR’s Business licence is sold to businesses. We do not knowingly collect personal data from children under 16.

Open-source software

OpenRAR uses libarchive (BSD licence), libarchive.js (MIT) and fflate (MIT). RAR is a format of RARLAB; OpenRAR is not affiliated with RARLAB or WinRAR.

The Mac app’s components and their licences are listed in the licence terms and in the app (About OpenRAR › Acknowledgements).

Changes

We may update this policy. The date at the top is the date of the version in force. If a change is significant, we will announce it on the site before it applies.