Privacy, Terms & Refunds

Last updated: November 3, 2026

Crest, Take and Minutes are Mac apps made by two independent developers and sold at crestnotch.app. This page says what the apps, Drop, Crest Cloud and this website collect, the terms of using them, how payment works, and how refunds work. Copyright and abuse reports have their own page. Questions? Email contact@crestnotch.app.

Privacy Policy

What the apps do on your Mac

Everything the apps do runs on your Mac. Crest's widgets, Take's recordings and Minutes' audio, transcripts and summaries stay there, except the passwords and Authenticator codes you choose to sync, files you send with Drop and files you keep in Crest Cloud. All three are encrypted on your Mac before they leave it, as described below. On their own, the apps report a few anonymous counts and, for Crest, a daily count of which features you use, all described below. The "Share anonymous install count" switch in each app's settings turns the anonymous counts off. Crest's update check says which tier it is on and whether its agent hooks are on, plus what became of the Authenticator card and whether it was installed with Homebrew. Versions before 6.5.1 also say whether the day-3 Pro reminder was shown. From 6.5.3, Crest also counts which Crest Pro and free week offers it showed you and which ones you pressed, with no install id, account or email attached. Crest also asks once how you found it, and sends your answer only if you give one.

The apps go online to sign you in, start a trial or a purchase, check the licence every few days and look for updates. Crest also asks our server twice a day whether a sale is on.

A few features fetch what they show straight from the source, only for the widgets you use, and none of it passes through us:

• Lyrics in Crest come from LRCLIB, which gets the song's title and artist.
• Weather in Crest comes from Open-Meteo for your rough location, looked up from your IP address by ipwho.is (or GeoJS if that fails). If you pick a place instead, Open-Meteo looks up the name you type.
• Pull requests in Crest come from GitHub, with the token you add.
• Album art for a song playing in Spotify comes from Spotify.
• Claude in Crest goes through Claude Code and your own Claude account.
• The multilingual engine in Minutes, if you choose it, is a one-time model download of about 600 MB from Hugging Face.

What we collect

• Your email. Downloading an app needs no account, and neither does Crest's trial. We store your email when you create an account or buy. Crest's free trial needs no account. It is where your licence lives, and we use it for your activation link, sign-in and password emails, receipts, trial reminders, and now and then news about the apps or an offer. If you installed Crest with Homebrew, starting your free trial or signing in from the app also notes that it came from Homebrew, and we store that with your account email once you have one. Activating a licence from that Crest notes it too. When you buy from inside a Crest installed with Homebrew, the purchase notes that too, so we can count sales that started there, and so does a purchase made with an account that came from Homebrew.
• Which Crest features you use. Once a day, Crest sends how many times you used each of its features that day: for example files sent or received with Drop, links made, files kept in or brought back from Cloud, passwords filled or saved, codes copied or filled, agent questions answered from the notch, files added to the Shelf, clipboard items pasted again, windows snapped, music controls pressed, which screens and pages you opened in the notch, which widgets are on your pages, and whether you opened Take or Minutes. It also sends the app version, whether you are on the free tier, the free week, after it, or Pro, and whether Crest was installed with Homebrew. When you are signed in, we keep these counts with your account email. When you are not, we keep them with your Mac's hardware identifier, and they join your account the next time you sign in. They are numbers only: never a file name, a password, a code, a prompt, a note or a website. We use them to see what people use and what they never find. "Share anonymous install count" does not stop them, because they belong to your account, and they are deleted when you delete your account.
• Your password, as a salted hash. We never store the password itself. If you sign in with Google or Apple instead, we store the account id and the email that Google or Apple shares with us.
• A device identifier. When you start a trial or activate a licence, the app sends your Mac's hardware identifier. We use it to keep one free week per Mac, enforce the 2-Mac limit, count active Macs, keep your usage counts while you’re signed out, and check trial and referral offers. We never sell it or use it for ads.
• An anonymous install count. When an app checks for updates, it sends a random install id that it made up the first time it ran. We use it only to count how many Macs use each app. It is not linked to your account, your email or your licence, and it says nothing about what you do in the app. With each check we also keep the app's name and version and a one-way hash of the check's IP address, never the address itself. Crest's check also says whether it is on the free tier, the free week, after the free week, or Pro, whether its coding-agent hooks are installed, what became of the Authenticator card (shown, added to a page, or put away), and whether Crest was installed with Homebrew (it checks only whether Homebrew's Crest folder exists), so we can count Macs in each group. Versions before 6.5.1 also say whether the day-3 Pro reminder was shown, and pass that answer to the Pro checkout. From Crest 6.5.3, the app also tells us when Crest shows you a Crest Pro or free week offer (at most once a day per offer) and when you press one: which offer, which plan you picked, whether you are on the free tier, the free week, after it, or Pro, and roughly how long ago Crest was installed. We keep those words with the time and the country the request came from. They carry no install id, account or email, and we never match them to you. The same switch stops them. To stop sending the id and these words, turn off "Share anonymous install count" in the app's settings. Updates keep working either way.
• How you found us, if you say. Once, after Crest Pro or its free week starts on a Mac, Crest asks "How did you find Crest?". If you answer, we keep your answer, and any words you type for Other, with your account's email, so we can see what brings people to Crest and count each person once. Choose Not now and nothing is sent. The thank-you page after you buy on our site asks the same question and keeps that answer with the payment's transaction id, never your email.
• Download counts. When you download an app, the site records which app, your country, the site that sent you, the first page you landed on here, the page you downloaded from and which version of it you saw. Each download gets a random id, so we can tell a download that reached a Mac from one that did not. When the file reaches a Mac, we keep a one-way hash of your IP address that changes every day, to see whether a free trial started from the same connection within two days, and we delete it after three days. Your email is added only if you are signed in.
• The link you email yourself. If you ask for the download link by email from your phone, we use your address once to send that one email, keep only a one-way hash of it for three days to stop the form being abused, then delete it, and never add you to a list.
• Payment details stay with the payment company. We never see or store your card, PayPal or wallet details. We receive your email, what you bought, the amount, your country and which version of our page you saw.

Authenticator sync

If you turn on sync in the Authenticator, your codes are encrypted on your Mac before they leave it, and only your Macs and your recovery key can open them. Our sync server never sees your 2FA secrets, your codes, the names of the sites and accounts they belong to, your notes, the names you gave your Macs, or your recovery key. It knows your account by a random id, not by your email address.

What it stores and can see: your encrypted codes, how many you have and their rough size; when each one was added, changed, moved to Recently deleted or deleted, and which of your Macs deleted it; your Macs' public keys, the public half of your recovery key, and when each Mac was added or removed; and when your Macs sync. A deleted code leaves a small record for 365 days, so a Mac that comes back after a long time can't bring it back. While you approve a new Mac, the server holds the kind of Mac asking (for example "MacBook Air") for about an hour and a half, or until the email telling you about it is sent if that takes longer. It counts recovery attempts, approval requests and resets, and keeps those counts for 2 days. Some request records are kept for up to 7 days so that a request sent twice is only applied once. Cloudflare, which runs the server, keeps each request's IP address, time, app version and Mac id in its logs for up to 7 days. What a request carried is never logged.

We email you when a Mac is added to your codes, when your recovery key is used, and when a reset of your codes is requested, cancelled or done. The sync server keeps a record of each of these emails, with your address partly hidden, for 90 days.

Turning off sync on a Mac removes that Mac from sync. Your encrypted codes stay on our server for your other Macs and your recovery key. A reset by email deletes your encrypted codes, your Macs' keys and your sync history from the server, 72 hours after we email you a link to cancel it. We keep a record that the reset happened for 90 days, then delete it. If you ask us to delete your Crest account, we delete your synced codes from the server too.

Crest's browser extension

Crest's extension for Chrome and Safari fills the passwords and codes you keep in Crest, and offers to save new ones to Crest. It works only with the Crest app on your Mac and talks to it directly on your Mac, through the browser's native messaging. It never sends anything to us or to anyone else, and it makes no network requests of its own.

To find your logins, the extension tells Crest the address of the page you're on when that page has a sign-in form. It passes a username and password to Crest only when you choose Save or Update, and it fills one into a page only when you pick it. It never stores a password. In the browser it keeps two things: the sites where you chose "Never for this site", stored as one-way hashes, and a random key that lets Crest recognise your browser after you approve it once in Crest. Removing the extension deletes both.

Crest Drop

Drop sends files to friends and makes links. Every file is encrypted on your Mac before it leaves it. A file you send to a friend can only be opened by their Macs. A link carries its key after the #, a part of the address your browser never sends to us, so only people who have the link can open the file.

Our Drop server never sees what is in your files, their names or their types. What it stores and can see:

• Your Drop name and tag (for example sam#4170), when you made it, and your friends, friend requests and groups.
• Your Macs' public keys, the kind of each Mac (for example "MacBook Air", never the name you gave it), its Crest version, and when each Mac was added or removed.
• For each file: who sent it, to whom, when, its encrypted size, and whether it was delivered, saved, unsent or reported.
• The encrypted file itself, only until it ends. A friend's file is kept 7 days, or until a day after every recipient saved it, so their other Macs can save it too. A link works for 1 hour after the upload finishes. Then the encrypted file is deleted, and anything missed is removed within 10 days. A short record of the file (who, when, size, how it ended) stays 30 days, so your Mac can tell you a file ended before it was saved.
• How many times a link was downloaded, not counting link-preview bots.

Cloudflare, which runs the server, may keep a request's IP address and time in its logs for a short time. What a request carried is never logged.

Anyone can report a link from its page. A report holds the reason picked and an optional note. Several reports from different networks take a link down by themselves, and we can also take one down by hand.

Crest Cloud

Crest Cloud keeps the files you choose, encrypted on your Mac before they leave it. Only your Macs and your recovery key can open them. We can't read them.

What our server stores and can see: your encrypted files and their encrypted sizes, when each was kept, changed or deleted, the links you make and how many times each was downloaded, and how much you keep and read back each month, so your plan's limits work. Its links work like Drop's: the key stays after the #, out of our reach.

Feedback from Crest

Reports you send from Crest's Feedback are kept for two years, and the diagnostics that come with them for 90 days, then deleted. You can ask for them to be deleted sooner at contact@crestnotch.app.

Measuring this website

Beyond the counts described above, the apps measure nothing. This website does, so we can see which pages help people and where they get stuck.

• Microsoft Clarity records how visitors use the pages: clicks, scrolling and page views, which it can play back as a session recording. Visitors in the EU, the UK and Switzerland get it without cookies; elsewhere it sets its own. Microsoft's privacy statement covers what it does with that data.
• Cloudflare Web Analytics counts page views and load times. It uses no cookies and does not identify you.
• Paddle's checkout loads its own scripts when a page offers a purchase, including ProfitWell, Paddle's own tool.
• Our own page count. Each page you open tells our server which page it was, the site that sent you, whether you are on a Mac, and which version of the page you saw. No cookie, id or IP address is kept with it.
• Trying two versions of a page. Some visitors see a slightly different version of a page so we can learn which one works better. Only which version you saw is stored, in your browser.
• Where a sign-in from the app started. When you sign in from the app, your browser passes along which page or link first brought you to crestnotch.app and your most recent download from it, so we can see which pages lead to trials. It is stored with your account and never shared.
• Our own download steps. The download window tells our server each step it reaches (it opened, the download started, where it was closed), with the app, the page, the site that sent you, your country and which version of the page you saw. No email, cookie or IP address is kept with those steps.
• Google Ads. If you reach us from one of our Google ads and you are outside the EEA, the UK and Switzerland, we keep the ad's click ID with your download and, if you sign up, with your account. We use it to tell Google Ads which clicks led to a download, a trial or a purchase, and what the purchase was worth. We share only the click ID, the step, its time and the amount, never your name or email. Outside the EEA, the UK and Switzerland, pages also load Google's ad tag, which can set Google cookies to recognise a visit that came from an ad. Inside those places it is not loaded at all, and the account and sign-up pages never load it.

How to opt out: a content blocker that blocks clarity.ms, cloudflareinsights.com, profitwell.com and googletagmanager.com stops those four services, and every part of this site keeps working, downloads and the checkout included. You can also ask us to delete what we hold about you (see below).

Who handles your data

We don't sell or rent your data. It is shared only with the services that run the business: Cloudflare hosts this site, stores accounts, licences and download counts, and holds the encrypted files of Drop and Crest Cloud on its R2 storage; Resend sends our emails; Paddle and NOWPayments take payments; Microsoft Clarity and Cloudflare Web Analytics measure the website; Google Ads receives the click ID and steps described above and, outside the EEA, the UK and Switzerland, the visits its tag measures.

The apps also reach LRCLIB, Open-Meteo, ipwho.is or GeoJS, GitHub, Spotify and Hugging Face straight from your Mac, and the AI service you set up, only when you use the feature that needs them (see above). We receive nothing from those requests.

Your choices

Want your email off our list, a copy of what we hold, or your account deleted? Email contact@crestnotch.app from that address and it gets done by hand. You can also delete your account yourself (see Deleting your account).

Payments and prices

• Card, PayPal, Apple Pay and Google Pay are processed by Paddle, our reseller and merchant of record. Paddle is the seller on your receipt, charges the tax your country requires, and sends the receipt.
• Crypto payments are processed by NOWPayments.
• Prices include tax, except in the US and Canada, where tax is added at checkout. Where a price is shown in your own currency, that is the price you pay. Every price is on the pricing page.
• Buying creates an account on the email you pay with. One activation link arrives by email: choose a password there, sign in inside the app, and it unlocks. Licence keys are never emailed, except once if you delete your account (see below); yours is on your account page if you ever want it.

Terms of Use

These terms cover Crest, Take, Minutes, Drop and Crest Cloud: Crest, Take or Minutes bought on its own, a Crest Cloud storage plan, and what was sold earlier: Take and Minutes added to Crest, all three apps bought together once or by subscription, and single-app licences bought before October 6, 2026.

• Every app is free to download. Drop, Crest Cloud and sync need a free account. Each app has a 7-day trial, no card needed, once per account and once per Mac: Crest starts it the first time it opens, with no account (Crest 6.6.4 or later); Minutes when you sign in; Take the first time you share or go live. When the trial ends, Take and Minutes stop until you buy them, and Crest pauses until you buy it, except that receiving files with Drop keeps working and your saved passwords, two-factor codes and notes stay readable. Your settings and files stay on your Mac. Without Pro, Crest does not answer Claude or Codex approvals, so you approve them in the terminal.
• Passwords and 2FA. Crest Pro, $14.99 once, includes everything in Crest except filling, adding and syncing passwords and 2FA codes. For a trial started or Crest Pro bought after Passwords moved into Crest Cloud, which comes with Crest 6.7, those are free for your first month: 30 days from the day your trial starts, or from the day you first buy Crest Pro if that is later, and the month never restarts. After that they come with a Crest Cloud plan. The free month covers Passwords and 2FA only: Crest Cloud storage needs a paid plan from the first day. When the month ends without Cloud, AutoFill, typing codes in, adding or changing logins and codes, and sync pause. Reading, showing, copying, searching and exporting your passwords, and your 2FA codes refreshing on screen, never pause, and nothing is hidden or deleted. Bought Crest Pro before Crest 6.7? Passwords, 2FA and sync stay yours for good. You need no Cloud plan for them.
• We sell Crest, Take and Minutes, each on its own. Crest Cloud (Drop + Cloud) is a separate storage plan, by the month or by the year. A friend’s referral link takes 20% off your first month of Cloud 50 GB, paid monthly. A Cloud plan started now includes no app. A Cloud plan started before Cloud became storage only keeps the apps it included for as long as it renews. All three apps together, and Take and Minutes as an add-on to Crest, are no longer sold: everything you bought stays yours, and a subscription keeps renewing at the price you signed up for. Prices are on the pricing page.
• You buy each app once. App subscriptions are no longer sold, and one started earlier keeps renewing until you cancel it. A licence is for your personal use on up to 2 Macs for each app. Please don't share, resell or distribute it.
• A one-time licence never expires. One bought now includes updates through Crest 7: every Crest 6 and Crest 7 release, and the Take and Minutes releases made in that time. The apps keep working after that, on the last version it covers.
• Licences bought before October 6, 2026 keep all future updates to that app at no extra cost, for life. Nobody will ask you to subscribe, and Passwords, 2FA and sync stay yours too.
• A subscription renews automatically every month or every year until you cancel, and includes every update while it is paid. Cancel any time from your account page: the apps keep working until the end of the period you paid for. If a payment fails, Paddle tries again and the apps keep working meanwhile. When a subscription ends, the apps stop, and your settings, recordings and notes stay on your Mac.
• A one-time licence works offline and is never switched off, unless the payment is refunded or charged back. A subscription runs while it is paid, with 30 days of grace offline. Passwords and 2FA filling, adding and sync follow the Passwords and 2FA item above.
• The apps are provided “as is”, without warranties of any kind. To the extent the law allows, we aren't liable for damages arising from their use.
• We switch a one-time licence off only when its payment is refunded or charged back.
• On a team, the owner can take back a seat they assigned and give it to someone else. The person who held it then loses access to the team's apps.

Sharing files with Drop

You can send with Drop when you have Crest Pro, a Cloud plan or a running trial, and getting files from friends always stays free. You are responsible for what you send. Please don't use Drop or its links to share:

• malware, or anything made to harm a device or steal data;
• phishing pages, or files that pretend to be someone else;
• anything illegal where you or the recipient are, including content that exploits children;
• files you don't have the right to share.

Files you get from friends are marked like any download, so macOS checks apps and installers before they open. Crest always asks before it saves an app, an installer or a script.

There are limits on how much you can send (today 2 GB a file and 20 GB a month, lower for new accounts). We may change them, and we say so in the app first.

We can't see what is in your files. If a link is reported, or we are told about abuse, we may take links down and switch off Drop for an account, and we tell the account by email. To report abuse, use the Report link on the page or email contact@crestnotch.app. Copyright notices go through our copyright page.

Keeping files in Crest Cloud

Crest Cloud keeps files you choose, encrypted on your Mac before they leave it. We can't read them: only your Macs and your recovery key can. That also means we can't get your files back for you if you lose every Mac and the recovery key.

Your plan sets how much you can keep, the biggest file, how long a link lasts and how much you can read back each month. The numbers are on the plan page and in the app. If we change a plan, we tell you first, and a change never deletes something you already keep.

When a plan ends. When a monthly plan ends, or a trial ends without a plan, your kept files are read-only for 30 days: you can get files back, download everything and delete, but not keep new files or make new links. On day 30 they are deleted. When a yearly plan ends, everything keeps working for 7 days, then the files are read-only until day 60, when they are deleted. While Paddle retries a declined card, Cloud keeps working as usual, and the days count from when the plan actually ends. After a refund or a chargeback the files are read-only for 30 days, then deleted, and after a chargeback links already sent stop at once. Choosing a plan again before the files are deleted keeps everything. We email you the day it ends and twice before the files are deleted (a week before and the day before), with the date and time. Your passwords and two-factor codes are never deleted by this.

Over your plan. If you move to a smaller plan and keep more than it holds, Cloud turns read-only until you are under it again. We never delete files in silence to make room.

The same rules as Drop apply to what you keep and share. You are responsible for what you keep and for links you send.

If we have to act on an account

Holding an account. If the law requires it, or we are told an account holds content that exploits children, we may hold the account: nothing can be kept, read or shared, and nothing is deleted, until the matter is settled. A hold never decrypts anything; we can't. We tell the account by email unless the law forbids it.

If Crest Cloud ever closes. We will email every account at least 90 days before, and Download everything stays free and working for those 90 days. Nothing is deleted before the 90 days are over.

Deleting your account

You can delete your account in Crest, Settings, Account. Download everything first: deleting your account deletes the files you keep, your Drop name, friends and groups, the files you sent that are still waiting, your synced codes and your sign-ins, and it cancels your plan. If you bought an app once, it stays yours: we email your licence key before anything is deleted. We keep only the record of what you bought, because tax law requires it.

Refund Policy

If something is wrong, email contact@crestnotch.app from the address you paid with within 7 days of a payment, a purchase or a subscription charge, and tell us what went wrong. A person reads every one and answers. This covers every purchase: Crest, Take or Minutes on its own, a subscription, a Crest Cloud plan, and what was sold earlier (Take and Minutes added to Crest, all three apps together, or a single app).

We refund when an app does not do what this site says it does, when it will not run on a Mac that meets the requirements we publish, when you were charged twice or bought the wrong thing, or when something is broken and we cannot fix it for you.

We may decline when an app has already been used to do the job it was bought for, such as a finished recording or an exported transcript, and when no reason is given. Every app is free to download and comes with a 7-day trial that needs no card, so nobody has to buy an app to find out whether it suits them.

Card, PayPal, Apple Pay and Google Pay orders are refunded through Paddle to the way you paid. For a crypto order, we arrange the refund with you by email.

Where the law gives you a right to a refund, you keep it whatever this page says, and Paddle, as the merchant of record, handles those requests under its own refund policy.

Contact

Crest · crestnotch.app · contact@crestnotch.app