# Privacy Policy

_Last updated: 2026-10-20_

Published at https://gusdev-cdn.stanify.app/tracewright/PRIVACY.md.

Tracewright is a local desktop and command-line tool. **It processes your images on your own
computer.** Your images, your exported files and the paths you open never leave it. The only
network connection the application can make is a license check, described below.

## What the software does with your data

| Topic | Behavior |
|---|---|
| Images you open | Read from disk and processed in memory. Never uploaded. |
| Vector files you export | Written only to the location you choose. |
| Optional CLI diagnostics | `--diagnostics` writes a local `.report.json` sidecar beside each export: tracing options, counts, timings, merge decisions and error measurements; no image pixels or source file paths. No report is written without this flag. |
| Network access | One host only: `licenses.stanify.app`, and only to activate, validate or deactivate a license. No image, file path or document is ever sent. |
| Telemetry, analytics, crash reports | None. |
| Accounts, sign-in, advertising | None. |
| Cloud services or third-party SDKs | None other than the licensing service operated for this product. |

## License activation

Tracewright is commercial software. Activating a license is the only operation that uses the
network, and it is the only reason the application contains an HTTP client.

What is sent to the licensing server, over HTTPS:

| Value | What it is |
|---|---|
| Application id | The fixed string `tracewright`. |
| License key | The key you were given. |
| Device id | A random UUID generated on this computer on first run. |
| Device secret | 32 random bytes generated on this computer, kept in the OS credential store. |
| Operating system | `windows`, `linux` or `macos`. |
| Device label | Optional text you type, for example "My laptop". |

Nothing else is transmitted. The license check never reads your images, your exports, your
file names, your user name or your computer name.

Once a license is active, the application verifies its signed token **locally** and works
offline. The token is a short document signed by the licensing server, valid until it expires;
a periodic online renewal is the only reason the application reconnects.

If you never activate a license, the application makes no network connection at all.

## What is stored on your computer

Tracewright keeps one small settings file so the app remembers your choices:

| Platform | Location |
|---|---|
| Linux | `$XDG_CONFIG_HOME/tracewright/settings.json` (usually `~/.config/tracewright/`) |
| macOS | `~/Library/Application Support/tracewright/settings.json` |
| Windows | `%APPDATA%\tracewright\settings.json` |

It contains: interface language, theme, view mode, auto-trace and outline toggles, last
export format and export options, the **path of the last folder** you opened an image from,
and the **installation device id**. It does not contain image contents, the device secret, the
license key or the activation token. Delete the file (or the folder) at any time to reset the app;
uninstalling the app does not remove it automatically.

The **device secret**, the **activation token** and the **license key** are kept in the
operating system's credential store, never in a plain file. The key is needed to renew the
token without asking you to type it again:

| Platform | Credential store |
|---|---|
| Linux | Secret Service (GNOME Keyring, KWallet, …) |
| macOS | Keychain |
| Windows | Credential Manager |

If no credential store is available, activation fails with a clear message rather than falling
back to a plain file.

## What exported files contain

Exported vector files include a generator note naming the product and version (for example
`Generator: Tracewright 0.2.1`). They do not include your user name, computer name, file
paths or any other personal data. The vector shapes themselves are derived from your image,
so treat an export with the same care as the original.

## File dialogs

On Linux the app opens file dialogs through the desktop's XDG portal, which is a local
service of your own system. On Windows and macOS it uses the native system dialogs. These
components belong to your operating system and follow its privacy settings.

## Distribution channels

Software downloaded from a website, package repository or app store is subject to that
channel's own privacy practices, which are outside this project's control.

## Children

Tracewright collects no personal data from anyone, including children.

## Changes

If a future version changes any of the above, for example by adding an update check or
telemetry, this document will be updated first, any such feature will be off by default,
and it will be listed in the release notes.