Privacy Policy
Last updated: 30 October 2026
Wharf is made by TOCLOCO LTD, and copies bought on wharf-app.com are sold by TOCLOCO Inc. The app is built to keep your information private. This policy explains what we do (and, mostly, don't do) with your data.
The short version
The app collects nothing. Wharf has no user accounts, no analytics and no advertising. It connects only to the servers you tell it to and, if you bought it on wharf-app.com, to wharf-app.com to check for updates.
If you buy Wharf on wharf-app.com, we keep the email address and name you give at checkout so we can send your license and re-send it if you lose it. That's all.
What we collect
From the app: nothing. Wharf does not gather personal information, usage analytics, device identifiers, or location. There is no sign-up and no login. Your license key is checked on your Mac, without contacting us.
Where your data lives
Your saved sites, host key trust decisions, folder access grants and activity log are stored on your Mac: inside the app's sandboxed container for the App Store edition, or in your Library folder for the edition bought on wharf-app.com. None of it is transmitted anywhere.
Passwords, SSH keys and key passphrases are stored in the macOS Keychain, protected by your Mac's own security. They are never written to a configuration file and never leave your machine except to authenticate to the server you are connecting to.
Your servers
Wharf makes network connections only to the servers you configure. It transfers the files you ask it to transfer, to and from those servers. We have no visibility of which servers you use, what you transfer, or what those files contain.
What happens to your data once it reaches a server is governed by whoever operates that server, which, in most cases, is you or your organisation.
The activity log
Wharf keeps a local record of connections, transfers and deletions so you can see what happened and export it if you need evidence for an audit. This log is stored only on your Mac. It is never uploaded, and you can clear it at any time.
Buying Wharf on wharf-app.com
Checkout is run by Stripe, who process your payment details under their own privacy policy. We never see or store your card details.
When a purchase completes, Stripe tells us your email address, name and order number. We use them to create your license key and email it to you. We store your email address, name, order number and license key with Amazon Web Services, in its London region, so that the "Find your license" page can send it again. We don't use them for marketing, and we don't share them with anyone else. To have them deleted, email support@tocloco.com; we'll then be unable to re-send your license, so keep a copy first.
Updates
The edition bought on wharf-app.com checks wharf-app.com for new versions about once a day, using the open-source Sparkle framework. The request carries Wharf's version number and nothing that identifies you. You can turn automatic checks off in Settings › License. The App Store edition is updated by the App Store.
This website
wharf-app.com uses DemandFlow Web Analytics, our own analytics service, to record the pages you visit, the page that referred you, your screen width, and clicks on downloads and links to other sites. It does not set a cookie. It stores the date of your first visit in your browser's local storage so we can tell new visitors from returning ones, and that date is not used to identify you. None of this applies to the app, which collects nothing.
Third parties
Apart from the payment and email services named above, none. Wharf does not include third-party advertising, analytics, or tracking SDKs, and does not share your data with anyone. Two open-source libraries, libssh2 and OpenSSL, are compiled into the app to speak the protocols, but these are part of the app itself, not external services, and they send nothing anywhere.
Children
Wharf does not collect personal data from anyone, including children under the age of 13.
Your rights
If you bought Wharf on wharf-app.com, you can ask us for a copy of the purchase details we hold, ask us to correct them, or ask us to delete them, by emailing support@tocloco.com. Otherwise we hold no personal data about you, so there is nothing for us to access, correct, export, or delete. Your saved sites, credentials and logs are yours: you can remove a site and its stored credentials from within the app, clear the activity log, or delete the app entirely.
Changes to this policy
If this policy changes, we'll post the updated version on this page with a new date.
Contact
Questions about privacy? Email support@tocloco.com.
TOCLOCO LTD, registered in England & Wales (company no. 09950859), 71-75 Shelton St, London, WC2H 9JQ.