Privacy Policy

1. Overview

This Privacy Policy explains how MacVisor, a macOS application developed by ScaleNinja Software LLP ("we", "us", or "our"), handles data. It covers the app, its background service, the per-VM runner processes, the mvz command-line tool, the network helper, and the MacVisor Agent that runs inside guests.

MacVisor is a local-first application. We cannot see which VMs you run, what is on their disks, which snapshots you take, or how often you use it.

2. What MacVisor sends over the network on its own

• License checks (keys.scaleninja.com, ScaleNinja's licensing server). When you click Start Free Trial (or run mvz license trial), activate, refresh, deactivate, or move a license; about once a week, during a trial too; after a license or trial ends, to look for a renewal; after a check that got no answer, again 5 minutes later and then at growing intervals up to every 6 hours; and when you try something that needs a license while MacVisor is waiting for the server's answer (at most every 30 seconds). Each request carries:
  • Hashed identifiers for this Mac: a SHA-256 hash of its hardware UUID and one of its serial number, never the raw values. They let the server tell one Mac from another, keep one trial per Mac, and recognise the Mac after a logic-board replacement.
  • The Mac's model (for example "MacBook Pro (14-inch, 2023)"), so you can tell your Macs apart when moving a license. Not the computer's name, which often includes yours.
  • The MacVisor and macOS versions.
  • A random one-time value (a nonce) that the signed answer must echo.
  • Your license key when activating, refreshing, or deactivating a license. Starting or checking the trial needs none.
  • With MacVisor's Network Helper on, the public half of a device key that proves later requests come from the same Mac. The private half never leaves the Mac.
  No request carries your email address, your computer's name, or anything about your VMs. The server answers with the license's edition and dates, the email on the order, and the masked key, which MacVisor shows in Settings. Its answers are signed, and MacVisor checks the signature on the Mac. Polar receives nothing from MacVisor: when the licensing server checks a key with Polar, it sends Polar only the key. A Mac that cannot reach the licensing server keeps working for 30 days after its last successful check (a limit the server sets); see Activate your license.
• Update checks (scaleninja.com). Once a day, if automatic checks are on, MacVisor downloads a signed release feed using Sparkle. The request carries no identifier for you or your Mac beyond what any HTTPS request reveals, such as your IP address; Sparkle's system profiling is off. Updates are never installed without asking. Turn checks off in Settings → Updates.

The free trial starts only when you ask. That is, when you click Start Free Trial (in Settings → License or the Setup Assistant's license step) or run mvz license trial. One exception: a Mac updating from a MacVisor beta that held a free-trial key, or a beta key the licensing server doesn't recognise, starts its trial by itself the first time it reaches the licensing server.

There is no third destination of ours. MacVisor sends no analytics, no crash reports, no usage pings, and no record of your VMs. The catalogue of cloud images and installers ships inside the app and is never fetched.

Local Network check. To find out whether macOS lets it reach your VMs, and to make macOS ask you, the app and the VM runner each send a one-byte datagram to the local multicast DNS group (224.0.0.251, port 5353) during setup and when the app opens, repeated every few seconds while macOS's permission prompt waits for your answer. It never leaves your local network and carries nothing about you.

Downloads you start

When you create a VM from a cloud image or installer, or run mvz images pull, MacVisor downloads the file from the source the catalogue names and checks it against a checksum before use: Linux images from the distributions' download servers, macOS installers from Apple's CDN, and, for a VM with the containerd runtime, the nerdctl tool from its GitHub releases. The checksum is either pinned in the signed catalogue or read over HTTPS from the checksum list the distribution publishes. Some of those servers (download.fedoraproject.org, download.opensuse.org) redirect to third-party mirrors near you, and a mirror may send the file over plain HTTP; MacVisor accepts that only for a file whose checksum it already has, and checks the file against it before use. A download without a known checksum, such as one from a URL you give it yourself, must use HTTPS throughout.

Asking for the newest macOS (macos-latest) asks Apple which build that is. When that build is in the catalogue, its pinned checksum is checked; when Apple offers a newer build than the catalogue lists, MacVisor downloads it from the HTTPS address Apple gives and does not check it against a checksum. Name a catalogue installer (macos-27, for example) to have it checked. These requests happen only when you ask for the image, and carry nothing about you.

Your guests' own traffic

A VM is a computer on your network. A Linux guest set up by cloud-init installs packages from its distribution's repositories (often through mirrors run by third parties), and the container runtime you chose from these sources: Docker on the RHEL family from download.docker.com; containerd's nerdctl from GitHub (github.com) when the copy MacVisor keeps on the Mac isn't there yet; and k3s through its installer from raw.githubusercontent.com, which downloads k3s from GitHub and, on some SELinux distributions, a policy package from Rancher's package repository, after which k3s pulls its own container images from public registries. A macOS guest talks to Apple as any Mac does. That traffic belongs to the guest, goes through your network, and never passes through anything of ours. Host-only networks and the per-network firewall let you restrict it; see Security model.

3. What stays on your Mac

• VMs. Each .macvisor package — configuration, disks, snapshots, saved state — lives in a storage location you choose, as ordinary files. Templates and downloaded macOS installers sit beside them.
• Provisioning data. A Linux VM made from a cloud image is configured with your Mac user name and UID, your SSH public keys, and any #cloud-config you provide; these are stored in the VM's configuration. A macOS VM with automatic setup stores the chosen account password in its configuration until the MacVisor Agent first connects from the guest, which shows the account exists; a VM with no automatic agent setup to come clears it after it has run for 30 minutes. If setup never gets that far, the password stays in the configuration. Protect VM storage accordingly.
• Licensing state. Your key and the licensing server's latest signed answer. With the Network Helper on, the helper keeps them for every account on the Mac in /Library/Application Support/MacVisor/Licensing, readable only by root, with its device key; a marker file beside it, /Library/Application Support/MacVisor/licensing-device-key, which any account can read, holds only a hash of the device key's public half. Without the helper they live in ~/Library/Application Support/MacVisor/Licensing.
• SSH material. MacVisor keeps a generated SSH configuration with each VM's pinned host key under ~/.macvisor/ssh, and its own key for setting up macOS 27 guests. Per-VM sockets live under ~/.macvisor/run while a VM runs.
• Logs. The app, the service, and each VM runner write logs under ~/Library/Application Support/MacVisor/logs. They are never sent to us.

4. Problem reports

Logs → Report a Problem… builds a zip you save wherever you choose. It contains the logs above; MacVisor's task records (what is running and recent history, such as downloads with their URLs); crash reports of MacVisor's processes from the last 14 days, from ~/Library/Logs/DiagnosticReports; and a summary: MacVisor and macOS versions, service and background-item status, licensing phase, the name, id, OS, state, resource settings, snapshot count, and package path of each VM, and the names of your custom networks. Nothing is uploaded; you read it first and send it to us yourself if you want help.

5. macOS permissions

MacVisor asks macOS for background-item approval for its service and its network helper (macOS may ask for an administrator's password for the helper), Local Network access for the app and the VM runner (to reach your VMs' addresses), Files and Folders access when VMs live on removable or network volumes, and the microphone only for a VM configured to use it. These permissions apply to your Mac's copy of MacVisor; they grant nothing to us. The network helper is the only component that runs as root, and it handles firewall rules, VLAN interfaces, the mvz and macvisor links, the .mvz and .macvisor name resolvers, and the license it holds for every account on the Mac — no data of yours.

6. The MacVisor Agent inside guests

The agent talks only to its VM runner, over a virtual socket, to provide shells, clipboard sync, file transfer, port tunnels, and guest information you ask for. It contacts no servers and reports nothing to us. A file the guest sends to the Mac needs your approval on the host. Automatic port forwarding, which VMs made from cloud images have unless you turn it off, needs none: ports the guest listens on appear on your Mac's 127.0.0.1, never on its other network interfaces, except ports where your Mac's own services usually listen.

7. What we see when you buy, start a trial, or activate

Polar.sh is our seller (Merchant of Record) and payment processor. When you buy a license, Polar shares your name and email address with us so we can deliver the key, provide support, and send important product and security notices. Polar handles checkout, receipts, refunds, and your orders in its customer portal. Payment-card details are processed by Polar's payment provider and never reach our systems. Polar no longer takes part in activation and receives nothing from the app.

ScaleNinja's licensing server (keys.scaleninja.com) is operated by us and runs on Cloudflare. It stores the Mac's identifiers only as keyed hashes of the hashes it receives, and your license key only as a keyed hash, so neither can be read back from its records. Starting the trial needs no email or payment details. What it keeps, and for how long:

• A record of each Mac — the keyed hashes, the Mac's model, the MacVisor and macOS versions, the device key's public half, and when the Mac was first and last seen — for as long as the Mac is known to it.
• A record of each Mac's trial — the Mac's hashed identifier, the trial's dates, and its status, with no email — indefinitely, so that each Mac gets one trial. If a Mac's trial was used by someone else (a second-hand or shared Mac), write to support@scaleninja.com and we can reset it.
• Which Mac used which license, and when, for as long as the license exists, so that moving a license can pick the Mac used least recently.
• For a license, the customer's email address (not their name), from Polar, for support and the "licensed to" line in Settings.
• A keyed hash of the IP address a trial was started from, for 2 days (a daily job clears it), to limit the number of new trials from one network (an organisation trying MacVisor on many Macs behind one address can ask support to raise the limit); and a keyed hash of the IP address an unknown license key is tried from, for up to a day, to limit guessing.
• A log of licensing events (activations, moves, trials started), for 12 months.

The licensing database doesn't store raw IP addresses. Cloudflare, which hosts it, sees the IP address each request comes from and may keep short-lived request logs that include it.

To have your records erased, write to support@scaleninja.com. Erasing removes your email, your Macs' models, and the event log about you; the keyed hashes and trial dates stay, so that each Mac still gets only one trial. Uninstalling MacVisor deletes its licensing state on your Mac, not anything on the server.

8. Support communications

If you email us, we keep your address and the message history so we can help and follow up. We do not ask for, and do not want, your VM disks or snapshots.

9. Website analytics

The ScaleNinja website uses Umami and Google Analytics to understand basic traffic and button usage. This is separate from the app, which contains no analytics code. See the main Privacy Policy for website analytics, cookies, retention, and your rights.

10. Children

MacVisor is not directed at children under 13, and we do not knowingly collect personal information from them.

11. Changes to this policy

We may update this policy as MacVisor changes. Material changes will be reflected in the "Last updated" date above.

12. Contact us

• General email: contact@scaleninja.com
• Support: support@scaleninja.com
• Website: scaleninja.com

Back to MacVisor