ICM VPN Privacy Policy

The short version

• ICM VPN connects your Mac directly to your organization's VPN server. Your traffic never passes through servers run by ICM.
• The app has no analytics, no tracking and no crash reporting, and it sends no data to ICM.
• Your profiles, logs and settings stay on your Mac. Passwords are kept in the macOS Keychain, and only if you choose to save them.
• Diagnostics leave your Mac only if you export them and send them to someone yourself.

Who is responsible

ICM VPN is developed by ICM. Write to hello@icm.sh with any question about this policy.

Your organization runs the VPN server you connect to and decides what that server records about your connection. Its own privacy notice applies to that data; ask your IT team for it.

What is sent to your organization's VPN server

To sign in and keep the tunnel up, the app sends your organization's VPN server:

• your username, your password and, if the server asks for one, a one-time code (OTP);
• the name of your Mac (its computer name), which the GlobalProtect sign-in includes;
• the client information GlobalProtect sign-in expects, such as a client version and the operating system type;
• your network traffic, through the encrypted tunnel, as the routes set by your organization decide.

The app does not send your Mac's hardware (MAC) address or serial number, and it does not send a host information (HIP) report.

What stays on your Mac

• Profiles: the name you give each connection, the VPN type, the server address, your username and connection options. They are stored in your user Library folder, readable only by your user account.
• Passwords: only if you turn on “Remember password”, in the macOS Keychain on this Mac. A saved password is deleted when you delete the profile or turn the option off.
• Certificate decisions: if you choose to connect to a server whose certificate macOS does not trust, the certificate's fingerprint is saved so ICM VPN can warn you if it changes. You are still asked on every connection.
• Logs: connection events such as server names, the address the VPN assigns you, DNS servers and error messages, to help you and your IT team solve problems. Passwords, session cookies and one-time codes are removed before anything is written. Each log is limited in size (about 20 MB) and older entries are overwritten.
• Settings: your language, detailed logs and “Stay connected when ICM VPN quits” choices.
• Connection state: while a tunnel is up, the background service keeps what it needs to restore your network settings, such as your DNS servers. It is deleted when the tunnel ends.

Diagnostics bundle

From the Logs window you can export a diagnostics bundle to share with your IT team or with us. It is saved where you choose; nothing is uploaded automatically.

It contains the app and background service logs, version numbers, your Mac model and macOS version, and your network configuration, such as IP addresses, routes, DNS and proxy settings, the names of other VPN configurations and installed system extensions. It does not contain passwords, session cookies or your Mac's hardware (MAC) addresses. Please look through it before you share it.

What ICM receives

Nothing, unless you contact us. If you email us or send us a diagnostics bundle, we use it only to help you and delete it once the issue is resolved. Messages sent through icm.sh are covered by our website privacy policy.

macOS itself may check a server certificate's validity online, for example its revocation status. Those checks are made by macOS, not by ICM VPN.

Legal basis

When you contact us, we process your message to answer you, on the basis of taking steps at your request and our legitimate interest in supporting our users (KVKK Article 5, GDPR Article 6). Data the app keeps on your Mac stays under your control and is not processed by ICM.

Coming changes

We plan to add license activation and automatic updates. These will make the app contact ICM's servers. We will update this policy before they are released.

Your rights

Under Article 11 of KVKK and the GDPR you can ask whether we process your personal data, get a copy, have it corrected or deleted, and object to its processing. Write to hello@icm.sh. You also have the right to complain to the Personal Data Protection Authority (KVKK) or to your local data protection authority.

Changes

We may update this policy. The date above shows when it was last changed.