Legal
Security and privacy
Effective 18.08.2026
This page explains how MacFullStack handles security and privacy: what stays on your Mac, what the sales site https://macfullstack.ru processes, and what we deliberately do not collect. Personal data on the site is governed by the privacy policy (152-FZ). The license is governed by the public offer. This page does not replace those documents; it describes the product architecture.
1. Two zones: the Mac and the sales site
MacFullStack is a local development stack. Projects, databases, dev mail, PHP logs, and web-server config live on the computer where the app is installed. https://macfullstack.ru is for product pages, payment, the account, issuing a key, and license checks. Your site source is not uploaded to the sales site.
If you attach a code snippet or a dump to a support message, it is processed as message content under the privacy policy — an exception, not a project-sync channel.
2. Local stack: Native and Docker
You choose the mode: a fully native stack on the Mac, or services in Docker. In both cases processes, volumes, and files stay under your control. Switching mode does not send projects to the Seller’s cloud.
The default sites folder is a local user directory (typically ~/MacFullStack/www, or the legacy ~/MacStack/www). Backing up that folder, Time Machine, and Finder permissions are your responsibility.
3. Databases, mail, logs, and admin tools
MySQL/MariaDB, Redis, Postgres, and similar services that MacFullStack starts listen on local sockets or ports on your machine (and the Docker network if you chose Docker). phpMyAdmin, Mailpit, and log viewers are local tools. They do not replicate contents to https://macfullstack.ru.
Database passwords you put in project .env files stay in those files. Do not publish .env files or dumps in public repos. 152-FZ compliance for personal data in your own databases (shops, CRMs, Bitrix) is yours as the operator of those systems.
4. HTTPS on local domains
Local HTTPS uses mkcert and a trusted local certificate authority on your Mac. Certificates are issued for names such as *.localhost and aliases you add. This is not a public Let’s Encrypt certificate for production and not an upload of keys to our servers.
The mkcert root lets the browser on this Mac trust local sites. Do not export it to other computers unless you must: it can sign local names on that machine.
5. Share: when a local site is reachable from outside
Share (Pro/Teams) opens a tunnel via Cloudflare or ngrok so a client can open your local site from a link. Traffic goes through the tunnel provider you chose, not the Seller’s hosting. While the tunnel is on, anyone with the link can see what your local server returns.
You decide what to publish: turn the tunnel off after the demo, do not share admin panels with production passwords, and do not point the tunnel at databases of client personal data without a lawful basis. The tunnel provider’s own policy applies separately.
6. Secrets on the Mac: Keychain and local files
Secrets the app manages are not sent to https://macfullstack.ru. Where the desktop app is integrated with macOS Keychain, secrets are stored there. Some studio data (Clients cards, local profiles) lives under Application Support on this Mac with restricted file permissions — not in iCloud Keychain and not in the website account.
The license key you enter in the app is stored locally for activation. A copy also exists in the account and the purchase email so you can reinstall. Do not paste the key into public chats.
7. MCP, editors, and third-party agents
The MacFullStack MCP server for Cursor and similar tools runs on your machine and gives the agent access to what you allow in the local environment (projects, stack, commands). Prompts and code that go to the editor’s cloud model are governed by that editor’s policy, not by https://macfullstack.ru. Disable MCP if you do not want the agent to reach local projects.
8. App updates
The app may request an update feed (appcast) and latest-version metadata from the sales site or a related CDN. Project source is not sent in that request. Typical update-check metadata may be sent (version, architecture, network headers).
Installing an update is your action. The Seller does not gain remote access to the Mac through the updater.
9. License and device
To enforce the plan’s device cap, the app calls the site API with the key, status, and a technical device identifier. Requests are rate-limited. Project source is not required or accepted to validate a key.
In the account you can revoke a device or reset the list. The signed license token lets the app verify Pro/Teams without a permanent connection; it is not encryption of your sites on our servers.
10. Sales site and account
https://macfullstack.ru stores account email, password hash, orders, promo codes, keys, seat and device limits, messages, and consents. Connections use HTTPS. Forms are CSRF-protected. Admin access is restricted. Server logs may include IP, time, and User-Agent within the privacy policy.
Cookies are necessary only: session, CSRF, language. There are no ad or analytics counters. Cookie details are in the cookie policy.
11. Payments
Card payments go through YooKassa. The full card number, expiry, and CVV never reach https://macfullstack.ru and are not stored there. We see payment status, amount, YooKassa ids, and the order email — to issue the key and the receipt.
A bank transfer, if agreed, uses the details in the offer. Do not email passport scans or card photos to support@macfullstack.ru unless we ask: a normal refund needs the order email and the key.
12. What we do not do
- we do not index or back up your www on our servers;
- we do not require a cloud account to run PHP, MySQL, or Redis locally;
- we do not embed advertising SDKs in the desktop app;
- we do not sell personal data;
- we do not claim the program cannot be patched: licensing deters casual and dishonest use, not a determined reverse-engineer of a binary on your Mac.
13. Your responsibility
You are responsible for macOS updates, project passwords, .env files, SSH/FTP access to production, what Share exposes, and personal data in your CMS. MacFullStack simplifies the local loop; it does not become the operator of your clients’ databases.
Do not expose local-stack services to the internet unless you must. Native and Docker are meant for development on your machine, not public hosting.
14. Incidents and requests
Suspected key leak, someone else in your account, or a site vulnerability: support@macfullstack.ru. Personal-data requests: privacy@macfullstack.ru. Reply times for personal data are in the privacy policy (as a rule, 10 business days).
This document is updated with the product. The revision date is above. Material changes are published on this page.