Skip to content

Legal

Security

Last changed on

This page says how Profile Porter keeps your computer and your data safe, and where that protection stops. What we keep about you, and why, is on the privacy page. If you find a weakness, write to support@profileporter.com.

The app

  • Profile Porter is signed with our Apple Developer ID and notarized by Apple, so macOS checks that it comes from us and hasn’t been changed. It runs with Apple’s hardened runtime.
  • The Windows app isn’t code-signed yet, so Windows may warn the first time you open it. Until it is, download it only from profileporter.com.
  • It reads your browsers’ files only on your computer, and never uploads what it reads. It reads cookie names, never their values, and the site names of saved passwords, never the passwords.
  • It needs Full Disk Access to read those files, which a sandboxed app can’t have, so the app itself isn’t sandboxed. You grant that access in System Settings and can take it back there at any time.

Updates

  • The app looks for updates at profileporter.com, over HTTPS.
  • On a Mac, each update is signed with our own update key as well as Apple’s. The app installs an update only when its signature matches the key built into the app you have, so a changed download is refused.
  • On Windows, the list of updates is signed with our own update key, and the app checks each download’s size and SHA-256 against it before it replaces itself.

Your license

  • Your license is kept in your Mac’s login Keychain, or on Windows, encrypted for your Windows account.
  • The app checks your license through our server, which asks Creem. The key that lets us reach Creem stays on our server, never in the app.
  • Our server signs each answer, and the app accepts only answers with a valid signature, so a faked answer doesn’t turn a license on.
  • The ID for your computer is a one-way hash of its hardware ID (on Windows, of Windows’ own ID for the PC). It can’t be traced back to the computer.
  • Payments go through Creem. Your card goes to Creem, never to us.

This website

  • Every connection to profileporter.com is encrypted. Plain http is sent on to https, and browsers are told to use only https for profileporter.com.
  • Each page allows only its own scripts, and no other site may show it in a frame.
  • There are no cookies and no outside trackers.

Reporting a weakness

Write to support@profileporter.com with what you found and how to see it. We answer every report, fix what is real as fast as we can, and tell you when it is fixed. We won’t take action against anyone who reports a weakness to us in good faith and doesn’t harm other people’s data or the service.