Privacy

What the app reads

To know when to wake your machine, goguma reads the schedulers you already have: your crontab, your user and system launchd jobs, Hermes's schedule store, and any app you have described to it with a manifest.

From those it keeps the job's name, its schedule, the command it runs, and a history of how long each run took and what it cost in battery. All of it is stored on your machine, in ~/Library/Application Support/goguma. None of it is sent anywhere.

What leaves your machine

Two things can, and both are listed here in full.

• The advisory feed. goguma fetches a signed list of known security advisories from getgoguma.com/advisories.json so it can tell you when the version you are running has a problem. It is a plain GET with no User-Agent beyond the Go runtime's default, no query string and no cookies — it carries nothing that identifies you or your machine.
• A webhook, only if you set one. If you configure a webhook_url, goguma posts job events to it. You choose the address and what it does with them. Configure nothing and nothing is sent.

There is no other outbound request. No usage statistics, no error reports, no check-in, no account.

What the app never touches

goguma does not read your clipboard, your documents, your browser, your keystrokes or your network traffic. It reads schedulers, and it asks the operating system about power: battery level, whether you are on mains, the lid, and the temperature. That is the whole surface.

This website

getgoguma.com loads no analytics, sets no cookies, and includes no third-party scripts. There is nothing here to opt out of.

The site is served by GitHub Pages, which keeps its own server logs of requests — including IP addresses — under GitHub's privacy statement. Those logs are GitHub's and we neither see them nor control them. The same is true of the release downloads, which are served from GitHub, and of Homebrew installs.

The mailing list

If you give us your email address on the updates page, it is stored by Buttondown, our email provider, and used for one thing: telling you when a bug is found in goguma and when it is fixed.

We ask for nothing but the address. It is never sold, rented or shared, and every email carries an unsubscribe link that removes you immediately. You can also ask us to delete it and we will.

Verifying any of this

goguma is open source under the MIT licence, so none of the above has to be taken on trust. Every network call in the codebase is in internal/advisory and internal/daemon/webhook.go, and SECURITY.md describes what runs with privilege and why.

Changes, and getting in touch

If this policy changes, the date at the top changes with it, and the edit is in the repository's history like everything else.

Questions, corrections, or a request to delete your address: open an issue at github.com/junnam586/goguma/issues.