TypeNBash By Vedant A. Desai

Privacy & Security

Privacy Policy

Effective Date: October 21, 2026

Previous versions of this Privacy Policy are available upon request by writing to vd@vadesai.com.

Summary of Key Points

This summary offers a brief overview. The full Policy follows, and the sections below control in the event of any inconsistency.

  1. What we collect: The Application does not collect personal information from you. TypeNBash is a macOS application distributed as a DMG and designed to operate entirely locally, so your project content (code, documents, notebooks, and similar material) is kept on your device. The Application does not send us your personal information, usage data, or telemetry. We only receive what you choose to send us, for example, when you email us for support.

  2. Sensitive personal information: We do not collect sensitive personal information. Where you connect a GitHub authorization key, the Application is designed to store it on your device, and we do not receive it or use it for any purpose beyond the function you request.

  3. Third-party sources: We do not receive personal information about you from third parties. Any integration you choose to enable, such as GitHub or any of your agentic LLM providers if applicable, operates at your direction and under that service's own policies.

  4. How we use it: Only to respond to messages you send us and to comply with the law.

  5. Who receives it: We do not disclose personal information to service providers or others, except as described in Section 4. We never sell your personal data, and we do not share it for cross-context behavioral advertising.

  6. Your rights: You may access, correct, delete, and obtain a portable copy of any personal data we hold about you, and you may exercise the other rights described in Section 5.

Contact: vd@vadesai.com, or https://vdesai.xyz/typenbash/.

1. Introduction

TypeNBash ("TypeNBash," "we," "us," or "our") publishes a multipurpose Integrated Development Environment for macOS (the "Application"). The Application is written in SwiftUI and AppKit for native performance and runs only on macOS. It is distributed directly as a DMG disk image. It supports polyglot projects, including Markdown, LaTeX, software code, and R and Python notebooks for data analysis and research. It includes an integrated console, a WebKit-based preview of localhost applications, optional GitHub integration for source control, or your own optional API provided LLM agents. The Application is designed to be local-first. Your working data resides on your device, in AppStorage and Swift data models, and the Application does not collect personal information on our behalf.

We regard privacy as a core attribute of the product. This Privacy Policy (the "Policy") sets out what personal information we receive (which is limited to what you choose to send us), how we use and disclose it, and what rights and choices are available to you. We have drafted it to be read and understood, not merely to be filed.

Scope. This Policy applies to personal information that we receive through the Application (and its packaged CiteTex extension), our website at https://vdesai.xyz/typenbash/ (the "Website"), and our related support communications (collectively, the "Services"). It does not govern the practices of third parties, including GitHub, or any application you preview through the Application's WebKit component. Those parties are subject to their own policies.

Questions. Privacy inquiries may be directed to vd@vadesai.com.

2. What We Collect & Why

The Application does not collect personal information from you, and it does not transmit your personal information, usage data, or project content to us. We receive only the personal information you voluntarily send us, for example, when you contact us for support. Because we serve users in multiple jurisdictions and are subject to U.S. state privacy laws, we identify below the purpose and legal basis for that limited information. Where we use the term "legal basis," we mean the justification for processing, whether contract, consent, legitimate interest, or legal obligation.

2.1 Information You Provide to Us Directly

Support and correspondence. When you contact us, we receive your email address, the content of your message, and any information you elect to include, so that we may respond and resolve your inquiry. Please do not include sensitive information, such as credentials or private project content, in your message. Legal basis: legitimate interest; consent.

We do not otherwise ask you for personal information in order to use the Application.

2.2 Information Collected Automatically

The Application does not automatically collect or transmit technical, usage, device, or diagnostic information to us. It does not include analytics, advertising, or crash-reporting services that send data to us. Information about how you use the Application remains on your device.

2.3 Your Project Content

The Application is designed so that your project content (source code, documents, notebooks, and similar material) is stored on your device, in AppStorage and Swift data models. It is not transmitted to us in the ordinary operation of the Application. Should you voluntarily transmit content to us, for example in a support request, we shall treat it in accordance with Section 17.

2.4 Information from Third Parties

We do not receive personal information about you from third parties.

User-directed integrations: If you connect a GitHub authorization key, the Application uses it, on your instruction, to communicate with GitHub for source control. As designed, the key is stored on your device and is not sent to us. Similarly, any use of the WebKit preview of localhost applications or your own agents occurs at your direction, and we do not receive the data involved. The data practices of those services are governed by their respective policies.

3. How We Use Your Information

Because the Application does not collect personal information, our use of personal information is limited to what you send us. We use it only for the purposes described below, and we do not process it in a manner incompatible with those purposes without providing notice and, where required, obtaining your consent.

Support and communications (legitimate interest; consent). To read and respond to messages you send us, provide technical support, and resolve your inquiries.

Legal compliance (legal obligation). To comply with applicable legal and regulatory requirements, and to respond to lawful requests.

We do not use personal information for analytics, profiling, advertising, or marketing.

4. When We Share Your Information

We never sell your personal data. We do not "share" personal information for cross-context behavioral advertising, as those terms are defined under the California Consumer Privacy Act, as amended (the "CCPA"), and comparable laws. We do not routinely disclose personal information to third parties. We disclose it only in the circumstances below.

Legal requirements. We may disclose information where we believe in good faith that disclosure is required by law, subpoena, court order, or other lawful process, or is necessary to protect the rights, property, or safety of TypeNBash, our users, or others.

Business transitions. In the event of a merger, acquisition, financing, reorganization, or sale of all or part of our assets, personal information may be transferred to the successor entity. Notwithstanding the foregoing, any such successor shall remain bound by the commitments of this Policy as to previously collected information unless you are given notice and, where required, an opportunity to object.

With your consent or at your direction. We shall disclose personal information for any other purpose only with your consent or at your direction. For example, when you instruct the Application to communicate with GitHub, that communication occurs directly from your device to GitHub.

5. Your Privacy Rights

Depending upon your state of residence, you may hold rights under the CCPA, the Virginia Consumer Data Protection Act, the Colorado Privacy Act, the Connecticut Data Privacy Act, the Indiana Consumer Data Protection Act, and other state privacy laws. As a matter of policy, we extend the rights below to all users, wherever located, subject to applicable law.

  1. Access. You may request confirmation of whether we process your personal information and obtain a copy of it.
  2. Correction. You may request that we correct inaccurate or incomplete information.
  3. Deletion. You may request deletion of your personal information, subject to legal exceptions, such as where retention is required by law or to defend legal claims.
  4. Portability. You may request your information in a structured, commonly used, machine-readable format.
  5. Opt out of marketing, sale, sharing, and targeted advertising. We do not engage in the sale or sharing of personal information or in targeted advertising, and we do not currently send marketing. You may still submit an opt-out request at any time.
  6. Withdraw consent. Where processing is based on consent, you may withdraw it at any time. Withdrawal shall not affect the lawfulness of processing carried out before withdrawal.
  7. Restriction and objection. Where applicable, you may request that we restrict processing or object to processing based on legitimate interests.
  8. Non-discrimination. We shall not discriminate against you for exercising any of your rights.

5.1 How to Exercise Your Rights

Submit a request to vd@vadesai.com, identifying the right you wish to exercise. We may require information sufficient to verify your identity, and we shall use it solely for that purpose. An authorized agent may submit a request on your behalf, provided that we may require proof of the agent's authority. We shall respond within the period prescribed by applicable law, which is generally 45 days and may be extended once where reasonably necessary, in which case we shall notify you.

5.2 Appeals

If we decline to act on your request, you may appeal by replying to our decision, or by writing to vd@vadesai.com with the subject line "Appeal." We shall inform you in writing of the outcome within the period required by applicable law.

5.3 Complaints

You may lodge a complaint with the relevant regulator. Depending on your residence, this may be the California Privacy Protection Agency or the California Attorney General, the Indiana Attorney General, or the attorney general of your state. We encourage you to contact us first so that we may attempt to resolve your concern directly.

6. Data Security

We implement reasonable administrative, technical, and organizational safeguards appropriate to the nature of the personal information we hold and the risks presented, consistent with an enhanced data risk profile. These include limiting access to personal information to persons with a legitimate need for it, and relying upon the infrastructure and security controls of our hosting and payment providers.

The local-first design of the Application is itself a protective measure. By keeping your project content on your device, we reduce the volume of sensitive material that traverses or resides on external systems.

  1. Limitations: No method of transmission or storage is entirely secure. We therefore cannot, and do not, guarantee absolute security.
  2. Your role: You are responsible for the security of your device and credentials. We recommend that you use strong, unique passwords, enable device-level protections available on macOS, keep your operating system and the Application current, and safeguard any GitHub authorization key. If you suspect that a key or account has been compromised, you should revoke the key and notify us promptly.
  3. Breach notification: In the event of a security breach affecting your personal information, we shall notify affected users and relevant regulators as required by applicable law.

7. Data Retention

The Application does not collect personal information, so there is no Application-generated data for us to retain. Project content and settings remain on your device, and you control them. The only personal information we hold is what you send us directly. We retain it only for so long as necessary to fulfill the purposes for which it was received, and thereafter only as required by law.

  1. Support correspondence: Retained for as long as reasonably necessary to respond to and resolve your inquiry and to handle any follow-up, and then deleted upon your request or when no longer needed.
  2. Legal holds and disputes: We may retain information beyond the foregoing period where necessary to establish, exercise, or defend legal claims, or to comply with law.

The rationale is simple. We keep information only while it is needed to help you, and we retain it beyond that point only where the law obliges us to do so.

8. Cookies & Tracking

The Application is a native macOS application and does not rely upon browser cookies for its operation. The Application's WebKit component renders localhost applications that you run. Any cookies those applications set are generated by your own projects, reside locally, and are within your control.

As to the Website, we do not use cookies or similar technologies for cross-context behavioral advertising. To the extent the Website employs cookies, they are limited to those necessary for its operation and security. Should we introduce non-essential cookies or analytics tools, we shall update this Policy and, where required, obtain your consent beforehand. You may manage cookies through the settings of your browser. We do not maintain a separate cookie policy at this time.

9. Children's Privacy

The Services are not directed to children under the age of 13, and we do not knowingly collect personal information from them. We do not knowingly sell or share the personal information of consumers under 16. If you believe that a child has provided us with personal information, please contact vd@vadesai.com. Upon verification, we shall delete the information promptly. A parent or legal guardian may contact us at any time to review or request deletion of a child's information.

10. International Transfers

We serve customers internationally, and our infrastructure and service providers may process data in multiple jurisdictions. Your personal information may therefore be transferred to, stored in, and accessed from countries other than your own, including the United States, which may have data protection laws different from those of your jurisdiction.

Where required, we implement appropriate safeguards for such transfers, such as the European Commission's Standard Contractual Clauses or other mechanisms recognized by applicable law. Regardless of where your information is processed, the rights described in Section 5 remain available to you.

11. Changes to This Policy

We may amend this Policy from time to time. Where changes are material, we shall provide notice by email to the address associated with your account, by prominent notice within the Services or on the Website, or both, before the changes take effect where practicable. The current version shall always be available at https://vdesai.xyz/typenbash/, bearing its Effective Date and Last Updated date. Previous versions are available on request. Personal information collected prior to an amendment shall be handled in accordance with the amended Policy, except that where the law requires your consent to a materially different use, we shall obtain it.

12. Contact Us

For questions, requests, or concerns regarding this Policy or our data practices:

Developer's Email: vd@vadesai.com
Website: https://vdesai.xyz/typenbash/

We shall acknowledge and respond to inquiries within the period required by applicable law, and we endeavor to respond sooner where practicable.

13. California Disclosures: Categories of Personal Information (CCPA/CPRA)

The Application does not collect personal information. The following table describes the only category of personal information we received in the preceding twelve months, in accordance with California Civil Code Sections 1798.100 and 1798.130. That category consists of information you voluntarily send us. Retention is subject to the legal-retention exceptions in Section 7.

CATEGORY SOURCES BUSINESS PURPOSES CATEGORIES OF THIRD PARTIES DISCLOSED TO RETENTION PERIOD
Identifiers and customer communications (email address and the content of support correspondence you send us) You Responding to inquiries; providing support; legal compliance None, except as described in Section 4 As long as reasonably necessary to respond to and resolve your inquiry, or until you request deletion, subject to Section 7

We have not collected any other category of personal information, including commercial information, internet or network activity, or device information.

  1. Sensitive personal information: We do not collect sensitive personal information as defined under the CCPA. If you connect a GitHub authorization key, the Application stores it on your device and uses it only at your direction; it is not sent to us. We do not use or disclose sensitive personal information for purposes other than those permitted by Section 1798.121(a) of the CCPA and its regulations. Accordingly, no right to limit its use is presently triggered. Should our practices change, we shall update this Policy and provide that right.

  2. Sale and sharing: We have not sold or shared personal information in the preceding twelve months.

14. Automated Decision-Making

We do not engage in automated decision-making or profiling that produces legal or similarly significant effects concerning you, within the meaning of Article 22 of the GDPR or comparable provisions of U.S. state privacy laws. No decision regarding your account, eligibility, or access to the Services is made solely by automated means in a manner that would significantly affect you.

15. Privacy Signals

We honor Global Privacy Control ("GPC") signals transmitted by your browser or device, and treat them as a valid request to opt out of the sale or sharing of personal information, as required in California, Colorado, Connecticut, Montana, Texas, and other jurisdictions. Because we do not sell or share personal information for cross-context behavioral advertising, a GPC signal does not change our existing practices, but we will continue to recognize it.

16. Sub-Processors

TypeNBash does not operate servers that process your App content, and accordingly engages a few sub-processors. The categories of providers that may process personal information on our behalf are limited to:

  1. Email service providers, which deliver and store correspondence sent to and from vd@vadesai.com; and
  2. Website hosting providers, which serve https://vdesai.xyz/typenbash/.
  3. Apple Inc. with macOS, if applicable, your chosen agent provider, and GitHub remote services are not our sub-processors. You engage them directly, and they process data under their own terms.

17. EU/UK Representative

TypeNBash is established in the State of Indiana, in the United States, and may make the App available to individuals in the European Union, the European Economic Area, and the United Kingdom. As of the date of this Policy, we have not appointed a representative under Article 27 of the GDPR or the UK GDPR. Individuals in the EU or UK may contact us directly at vd@vadesai.com regarding any matter concerning the processing of their personal information. We will update this Policy if we appoint a representative.

18. Supervisory Authority

You may lodge a complaint with the supervisory authority competent for your place of residence, place of work, or the place of the alleged infringement. We encourage you to contact us first so that we may attempt to resolve your concern directly, but you are under no obligation to do so. Competent authorities include:

Europe

  1. European Union / EEA: the data protection authority of your member state, as listed in the directory of the European Data Protection Board (https://www.edpb.europa.eu).
  2. United Kingdom: the Information Commissioner's Office (ICO) (https://ico.org.uk).
  3. Switzerland: the Federal Data Protection and Information Commissioner (FDPIC) (https://www.edoeb.admin.ch).

North America

  1. Canada: the Office of the Privacy Commissioner of Canada (https://www.priv.gc.ca).
  2. Indiana: the Office of the Indiana Attorney General (https://www.in.gov/attorneygeneral).
  3. United States (federal): the Federal Trade Commission (FTC) (https://www.ftc.gov).
  4. Other U.S. states: the attorney general or designated privacy regulator of your state of residence.

South America

  1. Brazil: the Autoridade Nacional de Proteção de Dados (ANPD) (https://www.gov.br/anpd).
  2. Argentina: the Agencia de Acceso a la Información Pública (AAIP) (https://www.argentina.gob.ar/aaip).

Asia & Pacific

  1. Australia: the Office of the Australian Information Commissioner (OAIC) (https://www.oaic.gov.au).
  2. New Zealand: the Office of the Privacy Commissioner (https://www.privacy.org.nz).
  3. Japan: the Personal Information Protection Commission (PPC) (https://www.ppc.go.jp/en/).
  4. South Korea: the Personal Information Protection Commission (PIPC) (https://www.pipc.go.kr/eng/).
  5. Singapore: the Personal Data Protection Commission (PDPC) (https://www.pdpc.gov.sg).
  6. Hong Kong: the Office of the Privacy Commissioner for Personal Data (PCPD) (https://www.pcpd.org.hk).
  7. India: Ministry of Electronics and Information Technology (MeitY): Data Protection Board of India (DPBI) (https://www.meity.gov.in/content/data-protection-board-india)

Middle East & Africa

  1. South Africa: the Information Regulator (https://inforegulator.org.za).
  2. Nigeria: Nigeria Data Protection Commission (NDPC) (https://ndpc.gov.ng)
  3. Kenya: Office of the Data Protection Commissioner (ODPC) (https://www.odpc.go.ke/file-a-complaint/)
  4. Israel: The Privacy Protection Authority (https://www.gov.il/en/pages/public_inquiries_ilita)
  5. Saudi Arabia: National Data Governance Platform (https://dgp.sdaia.gov.sa/wps/portal/pdp/services/ReportsComplaints)
  6. UAE: Data Office of the United Arab Emirates (https://u.ae/en/about-the-uae/digital-uae/data/data-protection-laws)

Global resources

  1. Global Privacy Assembly (GPA): an international forum of data protection and privacy authorities. Its website (https://globalprivacyassembly.org) provides information on member authorities worldwide, which you may use to locate the authority in a jurisdiction not listed above.

If your country or region is not listed, you may contact the data protection or privacy authority in your jurisdiction, or write to us at vd@vadesai.com, and we will do our best to help you identify the appropriate authority.