Walnut

Legal

Privacy Policy

Last updated: July 27, 2026

This Privacy Policy explains how Walnut (“we,” “us”) handles information when you use walnutlang.com, docs.walnutlang.com, packages.walnutlang.com, related websites, the package registry, and commercial license flows (the “Services”). It also describes what the local toolchain typically keeps on your machine.

Contact: [email protected] or [email protected].

1. Scope

This Policy covers information we process as operator of the hosted Services. It does not cover:

  • Data inside applications you build with Walnut (those apps are yours; you are the controller for your users)
  • Apple, Homebrew, Git hosts, analytics you add to your own apps, or other third parties with their own policies
  • Self-hosted registries you operate (you are responsible for that processing)

2. Information we collect

2.1 Information you provide

  • Account data for the package registry: email address, password (stored hashed), optional display name, organization membership
  • Billing and commercial seat details when you purchase or are granted Commercial entitlements (processed as needed to issue and renew seats; payment processors may receive card or invoice data if/when payments are enabled)
  • Package publishes: package name, version, metadata, and tarball contents you upload
  • Communications: messages you send to support or legal addresses
  • License requests: organization slug and account identity used to issue signed license files

2.2 Information collected automatically

When you access hosted Services we may log:

  • IP address, approximate location derived from IP, user agent, timestamps
  • Request paths (for example API calls to list or download packages)
  • Basic diagnostic and security logs (failed logins, rate limits, errors)

Static documentation and marketing pages may be served with standard web server logs. We do not require an account to read public docs.

2.3 Data that stays on your device

The Walnut CLI and related tools may store data locally under paths such as ~/.walnut/ (for example credentials, license files, preferences). That data is not automatically uploaded to us except when you explicitly run commands that contact the registry (login, publish, license issue/refresh, install from registry).

Signing keys, App Store Connect API keys, and development certificates you configure for device or TestFlight flows are intended to remain under your control (for example in your project manifest or environment). Do not send secrets to us unless a specific support process asks for redacted material.

3. How we use information

We use information to:

  • Provide, operate, and secure the Services (accounts, tokens, package hosting, license issuance)
  • Authenticate you and enforce seat and branding rules
  • Communicate about the Services, security incidents, and material Terms or Policy changes
  • Improve reliability and prevent abuse, fraud, and misuse
  • Comply with law and enforce our Terms of Service

We do not sell your personal information.

If you are in a region that requires a legal basis (for example the EEA/UK), we process data as needed to perform a contract with you, to pursue legitimate interests in running a secure developer platform (balanced against your rights), and to meet legal obligations. Where consent is required, we will ask for it.

5. Sharing

We may share information with:

  • Infrastructure providers that host our sites, databases, object storage, email, or error monitoring, under obligations to protect data
  • Payment processors if you purchase Commercial seats through them
  • Professional advisors (legal, accounting) under confidentiality
  • Authorities when required by law or to protect rights, safety, and security

Package contents you mark or leave public are available to registry users by design.

We do not share personal information with third parties for their independent marketing.

6. Cookies and similar technologies

Hosted sites may use cookies or local storage strictly necessary for security, sessions, or load balancing. We do not use personal data from the Services to run third-party advertising networks on walnutlang.com. If we add optional analytics, we will update this Policy and provide choices where required.

7. Retention

We retain account, package, and log data for as long as needed to provide the Services, resolve disputes, enforce agreements, and meet legal requirements. You may request deletion of your account subject to residual backups, legal holds, and data that must remain for integrity of published package history (for example yank records).

Local ~/.walnut files remain until you delete them.

8. Security

We use industry-reasonable measures (access controls, TLS in transit for hosted Services, hashed passwords, signed license files). No method of transmission or storage is perfectly secure. Protect your tokens and machines.

9. International transfers

We may process data in the United States and other countries where we or our providers operate. Where required, we use appropriate transfer safeguards.

10. Your rights

Depending on your location, you may have rights to access, correct, delete, or export personal information, or to object to or restrict certain processing. Contact [email protected]. You may also lodge a complaint with a supervisory authority where you live.

We will not discriminate against you for exercising privacy rights.

11. Children

The Services are not directed to children under 16. We do not knowingly collect personal information from children. If you believe we have, contact us and we will delete it.

12. Apps you ship

Walnut compiles your apps. End-user data collected by those apps is governed by your privacy policy and store disclosures. We do not receive that data through the toolchain unless you intentionally send it to our Services.

13. Changes

We may update this Policy by posting a new version with a revised “Last updated” date. Material changes will be highlighted by reasonable means when appropriate. Continued use of the Services after an update constitutes acceptance where permitted by law.

14. Contact

Privacy questions or requests: [email protected].
Legal: [email protected].

Related: Terms of Service, Licensing.