LangSwitcher privacy policy
Effective 2026-08-29.
LangSwitcher is a macOS menu-bar utility that rewrites a word typed in the wrong keyboard layout. To do that it has to see the keys you press. This page says exactly what happens to them.
LangSwitcher collects no data, and makes no network connections of any kind. There is no server to send anything to. There is no analytics, no crash reporting, no advertising, no account, and no third-party code in the app.
What is processed, and where it goes
The app watches key events system-wide, using the Accessibility permission you grant. For each key it keeps the key code — the physical key, not the character — for the word you are currently typing, in memory, together with the text each stroke produced. It renders those key codes under both of your layouts and scores the two readings to decide whether to correct.
That buffer is discarded at the end of every word. It is never written to a file, never written to a log, and never transmitted.
One more thing is held in memory: up to 50 words you have taken back by hand. Undoing a correction tells the app not to correct that word again, and it remembers the word for that purpose. The list holds nothing but those words, is capped at 50, is never written to disk, and is gone when the app quits. Settings ▸ General shows how many are held and has a button to forget them immediately.
What is stored on your Mac
One file: your settings.
~/Library/Application Support/LangSwitcher/settings.json
(In a Mac App Store copy, which runs sandboxed, the same file lives inside the
app's container: ~/Library/Containers/com.rownarts.LangSwitcher/Data/Library/Application Support/LangSwitcher/settings.json.)
It holds your own choices — the layout pair, the sensitivity level, the sound and pause switches, the hotkey, and the list of applications to stay out of. It contains nothing you have typed. You can read it, edit it or delete it; deleting it returns the app to its defaults.
The app writes four fixed diagnostic lines to the macOS unified log — that the
key tap started, stopped, was re-armed, or could not be created. They are literal
strings with no variable part except one of the two words timeout and
user input. No typed text, no key codes and no window titles appear in any log
line, at any level. A test in the project's suite fails if that stops being true.
Password fields
While macOS secure event input is on — you are in a password field, at the lock screen, or typing a password into a terminal — LangSwitcher observes nothing and corrects nothing. That rule has no exception and no setting that turns it off.
A list of common applications is excluded by default as well, matched by bundle identifier: Terminal, iTerm2, Ghostty, Alacritty and Warp; Xcode and Visual Studio Code; 1Password, KeePassXC and Keychain Access; VMware Fusion, Parallels, UTM and VirtualBox; Screen Sharing, Microsoft Remote Desktop, TeamViewer and AnyDesk. That is the whole list, not a rule about categories — another terminal or another password manager is not excluded until you add it, which you can do in Settings ▸ Exclusions. In an excluded application the app does nothing at all.
Permissions the app asks for
- Accessibility (System Settings ▸ Privacy & Security ▸ Accessibility). Two uses, both necessary and both described above: reading the key codes you type, and typing the replacement when it makes a correction. The key tap is created listen-only — it watches keystrokes, it never intercepts or swallows one meant for the app you are typing into. You can revoke the permission at any time, and the app stops working until you grant it again.
- Launch at login, if you switch it on. macOS handles that; the app stores only the fact that you asked for it.
Children
LangSwitcher collects nothing from anyone, of any age. It is not directed at children and has no content, accounts or communication features.
Changes to this policy
If the app ever changes in a way that affects this document, the document changes with it and the effective date at the top is updated. There is no mechanism by which an already-installed copy starts collecting or transmitting data — it has no network code and no remote configuration.