P0-07: Pricing — Deciding the Money

Scope: paid one-time, closed source, direct notarized distribution — the App Store sandbox makes this product impossible (Full Disk Access is incompatible with app-sandbox; see docs/research/03-os-constraints.md, “Distribute an FDA-requesting app through the Mac App Store: CANNOT”). Primary segment is developers / technical power users, per the scored verdict in docs/research/01-office-hours.md §5 — chosen specifically because it’s the only segment where reclaimable value (tens of GB of toolchain cruft) makes the purchase decision self-evident on the numbers, even though it’s the hardest segment to convert away from free tools (PureMac, Pearcleaner). Every number below is sized for that buyer, not the general consumer — 01-office-hours §3/§4 explicitly rules the general-consumer lane out as a support-cost trap unless proven otherwise by a paid-beta refund-rate test.

Competitive anchors, all from docs/research/02-competitors.md’s sourced pricing table unless noted:

Sensei is the closest true analog, not CleanMyMac: a small/solo studio, no malware module, Tahoe-ready, cleaner-not-suite, sold one-time at $59 for 3 Macs with a 14-day full trial. That’s the shape of business this product is, so it’s the shape of price this document anchors to — not CleanMyMac’s subscription-suite economics, which this product deliberately doesn’t try to match feature-for-feature (no malware scanning, no MDM, no continuous background agent — see the hard refusal rules in docs/research/08-risks.md).

1. Chosen SKUs

14-day full-feature trial, no crippling — every module including delete/quarantine/undo is live, because the entire trust pitch (see docs/research/05-trust-strategy.md) is the Review screen and the undo flow, and a user can’t evaluate “do I trust this to delete the right things” from a feature-gated demo. This is the explicit trade-off named in the task spec — “14-day full-feature beats crippled-forever for a trust-sensitive category” — and it matches Sensei’s own trial shape, the closest analog product.

Pay-what-you-want above a floor: rejected. It fits goodwill/open-source-adjacent products, but this product is positioned as the sustainable paid alternative to free OSS tools people can already read the source of (05-trust-strategy.md §“why should I trust a closed-source cleaner”). A PWYW floor invites “I’ll pay $1” behavior that undercuts exactly that positioning, and adds payment-flow/support complexity for revenue that’s marginal at this volume. The Education tier covers the “can’t afford $49” case without diluting the headline price.

2. Why $49 — and not $19 or $99

Not $19. At $19 the product reads as the budget option in a category where “budget” reads as suspicious, not affordable — MacKeeper’s entire reputational collapse (05-trust-strategy.md) is a standing reminder that cheap-and-aggressive is the exact profile users have learned to distrust in this category. It also doesn’t clear the unit-economics bar: at a ~$19 ASP the variable contribution margin per unit is roughly $9–11 (see §4 math scaled down), which would need ~1,100–1,400 units just to cover Year-1 fixed costs (§3) — an unrealistic volume bar for a niche developer-tool launch with no paid acquisition budget. And a developer who can get PureMac or Pearcleaner for $0 isn’t meaningfully more likely to buy at $19 than at $49 — the free alternative already wins on raw price at any low number; the only lever that works is trust and finish, not being the cheapest.

Not $99. $99 breaks the “buy once, cheaper than a year of the subscription” pitch that the entire one-time-pricing thesis depends on (02-competitors.md: “Our own ~$40/yr full-suite subscription lands directly on top of CleanMyMac’s Basic tier… pricing alone will not differentiate us” — the differentiator is buy-once, and $99 is 2.5x a year of CleanMyMac, which inverts the pitch from “cheaper than subscribing” to “trust me for 2.5 years upfront”). It’s also scope-mismatched: $99 is priced like a suite with malware scanning and fleet management, neither of which this product ships (08-risks.md’s hard refusal rules explicitly keep malware judgments and unscoped automation out of v1). Charging suite money for a single-purpose cleaner, in the one segment (developers) most likely to notice Pearcleaner already does a superset of the feature list for free, maximizes the “why not just use the free one” objection with no matching feature answer.

$49 is the number that survives contact with the actual comparables: just under Sensei’s $59 lifetime price (same business shape, closest analog), just under a year of CleanMyMac ($39.95, making “cheaper than one year, yours forever” literally true on day one), and high enough above DaisyDisk’s $9.99 to signal a broader-scope product without pricing into suite territory. It’s also a low-friction, no-real-decision price point for the target buyer (developer, disposable income, per 01-office-hours §2’s segment table) — nobody agonizes over $49 — while still funding a credible security audit and support budget without requiring the improbable unit volumes a $19 price would demand.

3. Cost model

3a. Payment processor choice

Verified current rates (WebSearch, Aug 2026):

• Paddle: 5% + $0.50/transaction flat, includes chargeback handling, acts as merchant of record (MoR) — handles EU VAT/sales-tax collection and remittance automatically.
• Lemon Squeezy: matches Paddle at 5% + $0.50 base, but adds +1.5% on international payments and payout surcharges for non-US bank accounts — makes the effective rate closer to Paddle’s once a meaningful share of buyers are outside the US, which is expected for a Mac developer audience.
• FastSpring: unpublished, negotiated, typically 5–8% — no pricing transparency at this volume, not worth pursuing pre-revenue.
• Stripe direct (DIY): nominally 2.9% + $0.30 (+0.5% for Stripe Tax to automate VAT calc), but DIY leaves us as the seller of record — EU VAT OSS registration is required once EU B2C sales exceed €10,000, with quarterly filing costing an estimated 4–8 hours/quarter minimum, plus separate US economic-nexus sales-tax exposure above ~$50K MRR. Stripe’s own new “Managed Payments” MoR product (2026 rollout) prices at ~7–9% effective — more expensive than Paddle while being a newer, less battle-tested product.

Decision: Paddle, as MoR. The ~1.6–2.1 point premium over raw Stripe processing buys a real thing this team doesn’t have and shouldn’t build: EU VAT registration, calculation, collection, and remittance across every jurisdiction a Mac developer might buy from, with zero ongoing compliance labor. At this company’s size (no finance/compliance function), that trade is unambiguous.

3b. Support cost estimate

A consumer disk utility is a documented ticket generator — permission-dialog confusion (Full Disk Access, per 03-os-constraints.md), “why didn’t this find my files,” and “my Mac isn’t faster” refund requests are called out repeatedly in 01-office-hours.md and 02-competitors.md as an endemic category tax. The developer/power-user segment is explicitly lower support cost than general consumers per 01-office-hours §2 (“technically literate, files own bugs well”) but higher scrutiny (will publicly flag safety bugs). Estimate, blended across the SKU mix:

• ~12 tickets per 100 sales (vs. an unsourced but commonly cited 20–30% contact rate for general-consumer utilities — halved here for the more self-sufficient developer buyer).
• ~$10/ticket average handling cost (≈15 minutes of founder time at a $40/hr fully-loaded rate, for the FDA-confusion/refund-request/false-positive-report ticket mix this category generates).
• Blended: $1.20 per unit sold (12 × $10 ÷ 100).

4. Unit economics

Modeled per 100 units sold at the blended ASP (Average Selling Price across the SKU mix — 75% Personal $49, 15% Multi-Mac $79, 5% Team-seat-equivalent ~$39, 5% Education $24.50 → ASP ≈ $52):

Break-even units = Year-1 fixed costs ÷ net contribution per unit = ($99 Dev Program + $12,000 audit + ~$400 hosting) ÷ $45.26 = $12,499 ÷ $45.26 ≈ 276 units — about 23 sales/month to cover the entire first-year fixed cost stack, including the full one-time audit. That’s a low bar deliberately: this is a niche, no-paid-acquisition-budget launch, and the pricing needs to clear break-even well inside the plausible range of outcomes, not just the optimistic one.

5. Refund policy

30-day, no-questions-asked, self-serve refund through the license portal — no phone call, no retention flow, no “are you sure” dark pattern. This is a direct extension of the trust stack, not a separate decision: the quarantine/undo retention window is also 30 days (05-trust-strategy.md §7), so “you have 30 days to change your mind” is one consistent number across the whole product, not two different policies to remember. It also directly follows the MacKeeper “never-do” list (05-trust-strategy.md): “never default subscriptions to auto-renew with a cancellation flow harder than the purchase flow” generalizes cleanly to “never make a refund harder to get than the sale was.”

Modeled refund rate: 5% base case. 01-office-hours §4 (Assumption 3) sets 15–20% as the red line that would flag the general-consumer lane as a support-cost trap; 5% is a deliberately conservative developer-segment estimate, sitting well under that line, and is treated as the number to watch in a real beta — if actual refund rate approaches double digits even in the developer segment, that’s a signal the false-positive/trust mechanics (not the price) need work before scaling spend.

6. Licensing ↔ trust stack

The entire trust strategy (05-trust-strategy.md) commits to zero telemetry by default and no network calls except explicit, user-initiated ones (“Verify against published rules,” opt-in update checks). Licensing has to honor that same contract, not carve out an exception for itself:

• Offline activation. At purchase, Paddle/Lemon Squeezy issues a license key; a lightweight fulfillment step (a Cloudflare Worker or similar, not a persistent licensing SaaS) signs a license file (Ed25519) containing the SKU, machine allowance, and purchase date. The app verifies that signature against a public key embedded at build time — entirely offline, every launch. No license server is contacted at runtime, ever.
  • This also means $0 recurring license-infra cost (§3) — a direct byproduct of the no-phone-home commitment, not a separate optimization.
• Machine-count enforcement is honor-system beyond a generous allowance, not DRM. Because there’s no phone-home, there’s no way to cryptographically enforce “exactly 2 Macs” without either a server check (which the trust stack forbids) or hardware-fingerprint lock-in (which is exactly the kind of hostile-to-the-user mechanism this product’s whole positioning argues against). The chosen trade-off: price the machine allowance generously enough (2/5/per-seat, §1) that honest use never bumps into it, accept that a shared license file is a real but low-value leakage path, and don’t spend engineering effort trying to close it with anything that would compromise the no-phone-home promise. This mirrors DaisyDisk’s and Sensei’s own norms (5 Macs / 3 Macs, no aggressive enforcement) — it is standard practice in this exact product category, not a novel risk.
• v2 upgrade pricing is verified manually, not by phone-home. A user requesting the discounted v2 upgrade key enters their original license key/email in the download portal; eligibility is checked against purchase records at that point (a one-time, user-initiated portal action — not a background check), consistent with “no network calls except explicit, user-initiated ones.”

7. Three-scenario 12-month P&L

Same fixed-cost stack across all three scenarios ($12,499 — the audit is a release gate, paid regardless of how sales go). Variable assumptions tighten in the optimistic case (better refund rate from a more mature review-screen/false-positive loop, lower support-ticket rate from a growing FAQ, and a richer SKU mix as Multi-Mac/Team traction builds the ASP) and loosen in the pessimistic case (rougher early edges, heavier support load, less SKU-mix upsell).

Reading it honestly: the pessimistic case is a real loss — 200 units in a year (≈17/month) from a niche, no-ad-budget developer-tool launch is not a fantasy floor, it’s a plausible outcome if the 01-office-hours falsification tests (the fake-door landing page, the 20–30 developer survey) come back weak. The base case clears break-even by a comfortable 3x margin at a volume (800 units/yr, ~67/month) that a Hacker News “Show HN” + r/macapps launch plus modest ongoing SEO could plausibly sustain for this segment size (§ developer population ~14.6M per 01-office-hours.md §2). The optimistic case assumes real word-of-mouth traction inside the developer community this product is betting everything on — it is upside, not the plan.

8. Summary of decisions

Sources

• Paddle vs FastSpring vs Lemon Squeezy pricing comparison — Fungies.io
• Dodo Payments — Cheapest Merchant of Record for SaaS in 2026
• Merchant of Record Pricing: the complete 2026 guide — Fungies.io
• Stripe Managed Payments vs Merchant of Record 2026 — Fungies.io
• Stripe Fees vs App Store Fees for Digital Goods (2026) — Mirava
• How Much Does Penetration Testing Cost in 2026 — Invicti
• Pentest Cost 2026 — pentestingcost.com
• Cure53
• Cross-referenced: docs/research/01-office-hours.md, docs/research/02-competitors.md, docs/research/03-os-constraints.md, docs/research/05-trust-strategy.md, docs/research/08-risks.md