Skip to content
Follow on X (opens in a new tab)

Privacy policy

The app keeps its history on your computer, and this website sets no cookie. The few things that do go online are listed here in plain language.

Effective date:

On this page

Overview

  • The files, folders and programs the app records stay on your computer. They’re never uploaded.
  • There’s no account and no login. My server keeps your license key only in a form that can’t be turned back into the key.
  • The app collects no usage statistics, and the website loads no analytics script.
  • Two checks go online: the license check and the update check.
  • I never sell or rent data, and I use it for nothing but what this policy describes.

Who is responsible

I’m the controller of the data described here: the sole proprietor named in the legal notice, who makes CapyWatcher as Admiral Capy. For any privacy question or request, write to support@capywatcher.com.

The app

The app keeps its history on your computer: the files it recorded, the programs that created them, which program started those programs, and when. The service that watches your folders has no network access. The history is never uploaded, and it stays until you delete it or uninstall the app.

The license check and the update check

Both go to my server at api.capywatcher.com.

  • The license check, during the free trial and with a license. It sends a random ID for this computer’s place on the license, the server’s last signed answer, a one-time number and a signature made with a key that never leaves this computer. The first check also sends this computer’s public key, and entering a license key sends that key.
  • The update check. It sends the app’s version number with the same ID and signed answer, and gets back whether a newer version exists and a download link that works for 15 minutes.

Neither check sends your files, your folders, your history, your computer’s name or an email address. The server sees each check’s IP address while it answers, to limit how many requests one address can make, and doesn’t store it.

Legal basis: the checks are how the trial and your license work, so they’re needed to perform our agreement (GDPR Article 6(1)(b)). Limiting requests protects the server from abuse, my legitimate interest (Article 6(1)(f)).

What the license server stores

  • For each license: a keyed hash of the license key, keyed hashes of Creem’s checkout, order and subscription numbers, the plan, the date it’s paid until, its status and the day it was created.
  • For each computer on a license: a random ID, the computer’s public key, and the first and last day it checked.
  • For each free trial: the computer’s public key and the day the trial started.
  • For each activation of a key: the day, and whether it was refused because the license was full.
  • For each license and week: counts of unusual activity, used to find a key that is shared or leaked, and an estimate of how many networks the key was used from. The estimate is built from the network part of each check’s IP address, hashed with a value that is deleted when the week ends, so no address can be read back from it.
  • For each refunded purchase that arrives before its license: keyed hashes of Creem’s order numbers.

The server stores no name, email address, IP address, hardware ID, computer name or payment details. A full copy of its database couldn’t tell anyone who you are.

Legal basis: the license, computer and trial records are needed to perform our agreement (Article 6(1)(b)). The activity counts and the refund records stop keys from being shared or claimed after a refund, my legitimate interest (Article 6(1)(f)). No decision about you is made by automated means alone: the app can warn about a key, but only I can block one.

Payments

Creem (Armitage Labs OÜ, Estonia), the Merchant of Record, sells the license and takes the payment. It holds your payment details, your billing address and the email address you give at checkout, as a controller in its own right, under its own privacy notice (opens in a new tab). When you buy, renew or get a refund, Creem tells my server about it. The server keeps only the keyed hashes listed above and nothing else from Creem’s message.

This website

  • The website sets no cookie, loads no analytics script and loads nothing from another site, except the check on the legal notice.
  • Page counts: for each page view, the website’s server records the page’s path and the name of the site that linked to it, if any. Nothing else: no IP address, no browser details, no cookie and no ID. These counts can’t be linked to a person.
  • The theme: when you switch between the light and dark theme, your browser stores your choice under the name theme in its local storage. You asked for it, it holds nothing about you and it never leaves your browser. Clearing this site’s data in your browser removes it.
  • Delivery: Cloudflare, which runs the website and the license server, handles each request, including its IP address, to deliver it and to protect the website from attacks. Legal basis: my legitimate interest in a website that works and stays safe (Article 6(1)(f)).

Support messages

When you write to support@capywatcher.com or send a direct message on X, I use your message, your email address or X handle, and anything you include, such as the app’s debug information, only to answer you and to fix the problem you report. I never add you to a mailing list. Support messages never go to an AI tool.

Legal basis: answering a question about your license or a purchase is part of our agreement (Article 6(1)(b)). Answering any other message is my legitimate interest in replying to people who write to me (Article 6(1)(f)).

When you open the legal notice, Cloudflare Turnstile checks in the background that your browser isn’t a bot before the page shows my details. You don’t click or solve anything. Your browser loads it from challenges.cloudflare.com, and Cloudflare receives your IP address, your browser’s user agent and TLS fingerprint, and this site’s address. Cloudflare uses them to tell people from bots for me, and as a controller in its own right to improve Turnstile, as its Turnstile Privacy Addendum (opens in a new tab) says. No other page loads it.

Cloudflare keeps one entry for the check, cf.turnstile.u, in your browser’s local storage for challenges.cloudflare.com.

Legal basis: my legitimate interest in keeping my personal details away from bots and scrapers (Article 6(1)(f)).

Who else handles data

  • Cloudflare, Inc. runs the website, the license server and its database, checks visitors to the legal notice with Turnstile, and receives mail sent to support@capywatcher.com and passes it on. It processes data for me under its data processing addendum (opens in a new tab). Cloudflare is based in the United States and certified under the EU-US Data Privacy Framework, and its addendum includes the EU’s standard contractual clauses.
  • Proton AG (Switzerland) and Google (Gmail) hold the mailboxes support mail is delivered to. Switzerland has an adequacy decision from the European Commission. Google may process mail in the United States under the EU-US Data Privacy Framework.
  • Creem handles payments as a controller in its own right, as described under Payments.
  • X carries direct messages you send on X, under X’s own privacy policy.

How long data is kept

  • One-time numbers: 5 minutes. The weekly value that hashes network addresses: deleted when the week ends.
  • Weekly activity counts: deleted after 3 weeks. Activation days: deleted after 30 days.
  • A computer’s record: deleted when you remove the computer from the license, or after 60 days without a check.
  • License, trial and refund records: kept while the license service runs, so a lifetime license keeps working and a trial or a refunded key can’t start over. They hold only hashes, random IDs, public keys and days.
  • Page counts: 3 months.
  • Support messages: deleted 2 years after the last message in the conversation.

Your rights

Under the GDPR you can ask for access to the data about you, its correction or deletion, a limit on its use, or a copy to take elsewhere, and you can object to any use based on my legitimate interest. Write to support@capywatcher.com, and I answer within one month. The license server holds no name and no email address, so a request about a license needs its license key.

You can also complain to a data protection authority. In Poland that’s the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl (opens in a new tab). You can also turn to the authority where you live or work.

Children

CapyWatcher isn’t meant for children under 16, and I don’t knowingly collect data about them.

Changes to this policy

If this policy changes, the new version is posted on this page with its date. If a change affects what the app sends, the release notes say so.