Privacy
What is collected, what never leaves your device, how long things are kept, and who else is involved.
Local first, opt-in, minimised
- Local protection never depends on the cloud being reachable.
- File contents, full paths, browsing history, keystrokes, clipboard and screen never leave the device.
- Cloud reporting is opt-in on consumer devices and revocable at any time, including for events already queued.
- Sample upload of files is not implemented and is deferred.
- Retention is set per kind of data and stated below with what is actually switched on today.
What may leave a device
Every event carries a privacy class. Anything not explicitly classified is treated as restricted, because a misclassification in the other direction cannot be undone.
| Data | Class | May leave the device? |
|---|---|---|
| File contents | restricted | Never |
| Full file path | restricted | Never — the file name only, if a feature needs it |
| Browsing history | restricted | Never |
| Keystrokes, clipboard, screen | restricted | Never |
| A URL you paste into the link checker | restricted | Never — the verdict and hostname only |
| Device name, OS, version | operational | With consent |
| CPU, memory, disk, uptime | operational | With consent |
| Detection category, severity, rule, confidence | security | With consent |
| ATT&CK technique | security | Added by our server, never by the device |
| Link verdict and hostname | sensitive | With consent |
Operational data stays on the device. Nothing is reported.
Operational, security and sensitive classes, with redaction. Revocable at once; the server refuses telemetry from a device with reporting off.
Raw files. Not implemented, and deferred.
How long data is kept — as configured, not as intended
The periods are engineering defaults pending legal review. Where a pruning job exists but is switched off, we say so.
| Data | Period | What is actually happening | |
|---|---|---|---|
| Host metrics | 7 days | Implemented and bounded | Available |
| Anomaly records (hub) | 30 days | On in production since 1 October 2026 | Available |
| Security events and resolved incidents (hub) | Not set | A pruning job exists but is off until a period is approved, so nothing is deleted yet | Limited |
| Audit trail | 1 year (design default) | Pruning is off, so nothing is deleted; enabling it needs the owner's approval | Limited |
| Desktop detections, alerts, incidents | 90 days on the device | Raw events 30 days. In the desktop app, which is an unsigned pre-release | Not released |
| Quarantined files | Until you act | Released only by you, never by a timer | Not released |
| Android commands not delivered | 7 days | Expire if the phone never collects them | Available |
| Backups | 14 days, at least 3 kept | Daily; encrypted off-site copy recorded in the operations documentation | Limited |
What the phone app sends when it is linked
- Posture signals: screen lock, encryption, unknown sources, developer mode, root, device administrator, remote-access apps
- A fingerprint (SHA-256) of the installed-app list; the list itself only when it changed or the server does not hold it (version 4.2)
- Risk findings about installed apps
- Location: only if you turn on sharing with every check-in, or while a locate request is waiting (version 4.2). Unlinked phones do not ask for location at all.
- Screen view: only during a session you approve on the phone each time.
- Nothing at all while the phone is not linked to a console.
Services the code calls, and what they receive
This is read from our code, not a formal sub-processor list; that list is still to be published with the final privacy policy. We do not sell personal data.
| Service | When | What it receives |
|---|---|---|
| Hosting provider (Linode) | Always: the service runs on one server we operate there | Everything the service stores |
| Have I Been Pwned — Pwned Passwords | When you check whether a password has appeared in a breach | The first 5 characters of the password's SHA-1 hash only; your browser compares the rest |
| Configured exposure provider | Only for a verified email check or opt-in monitoring schedule, when a provider is configured | The verified email address you chose to check; no automated result without a provider |
| VirusTotal | Only if an operator configures a key (not configured today), for a file-hash lookup | The file's SHA-256 hash, never the file |
| URLhaus (abuse.ch), OpenPhish | When web protection refreshes its threat feeds | Nothing about you: the feeds are downloaded |
| Your alert channels | When an alert fires, to the email, Slack, Discord, Telegram or webhook you configured | The alert text |
See it, take it, delete it
From Account in the console: your profile, devices, server details, your devices' threats and incidents and your own audit trail, as JSON. No secrets are included.
Request deletion from Account. You can withdraw it for 7 days; after that an operator removes the account. It is not instant.
See where you are signed in and end any session. Access tokens are revoked on sign-out and last one hour by default.
Anything else — correction, a copy in another form, a question about a specific record — write to [email protected] with the subject "Privacy request". Read the privacy policy (draft).