Privacy

Version 1.0 - effective 2026-11-01 License Tracker is made by Dane Wagenhoffer ("the publisher"). This statement explains what data the program handles, where it is kept and which network requests it makes. In short: your data stays on your computer, encrypted. There is no account, no cloud sync and no telemetry. The publisher never receives your records. 1. WHAT IS STORED, AND WHERE Everything is stored on your computer, in your Windows user profile. %APPDATA%\License Tracker\ licenses.db Your vault: every license, developer, vendor, custom field, icon and scanner result. Encrypted (see section 2). licenses.db.keymeta.json The random salt and settings used to turn your master password into the vault key. Not secret, but needed to open the vault. backups\ Automatic encrypted snapshots of the vault, each with its own .keymeta.json file. product-license.json The date your trial started and, once you activate, your license key. The key is signed by the publisher and contains the name and email address it was issued to. This file is not encrypted. %LOCALAPPDATA%\License Tracker\logs\ server.log (and up to four older files, about 1 MB each) Start-up, shutdown and error messages. The log is designed never to contain your password, keys or license secrets, and anything shaped like a password, token or key is masked before it is written. It can contain file and folder paths. When you change your master password, a copy of the vault from before the change is kept next to licenses.db (it opens with the old password). When you start a new vault from "Forgot your password?", the old vault is set aside next to licenses.db, not deleted. If you use the "lt" command-line tool, it saves a session token in the folder .licensetracker in your user folder. The token only works while the program is running and the vault is unlocked. Files you choose to export (CSV spreadsheet, .ics calendar, JSON backup file) are saved wherever you put them. CSV and .ics files are not encrypted. CSV exports never include license keys, passwords or notes. A JSON backup either leaves sensitive fields out or encrypts them with a passphrase you choose. 2. ENCRYPTION Your master password is never stored. When you unlock, the program derives a 256-bit key from it with Argon2id (512 MB of memory, 3 passes, 4 lanes, falling back to 256, 128 or 64 MB on computers that cannot spare the memory). The key is kept in memory only, and is wiped when the vault locks. The vault is protected in two layers: - The whole database file is encrypted page by page with SQLite3 Multiple Ciphers using ChaCha20-Poly1305. - The most sensitive fields are encrypted a second time, individually, with libsodium secretbox (XSalsa20-Poly1305): license keys, order numbers, registered email addresses, account user names, notes, vendor account passwords, and any custom field you mark as encrypted. Snapshots are encrypted the same way, with the password in use when they were taken. There is no recovery key and no backdoor. If you forget your master password, nobody, including the publisher, can open your vault. 3. NETWORK REQUESTS The program runs a small web server that listens only on this computer (127.0.0.1). It cannot be reached from your network or the internet. It makes outbound internet requests in exactly these cases: a. Update check, once at start-up. A normal HTTPS GET request for https://licensetracker.danewagenhoffer.com/updates/latest.json The request carries a User-Agent header with the program's version number (for example "LicenseTracker-UpdateCheck/3.0.0") and no other information about you or your data. As with any web request, the server sees your IP address. The answer is a small file, signed by the publisher, that names the newest version. The program only shows a notice; it never downloads or installs anything by itself. To turn the check off, set the environment variable LICENSETRACKER_UPDATE_CHECK=off b. Icon fetching. Icons for licenses, developers and vendors can be fetched from the web. This happens when you click a fetch-icon button, when you add a developer or vendor with a website (its icon is fetched right away), and when you run "lt seed". The program then: - requests the website you entered for that developer or vendor (its home page and the standard /apple-touch-icon.png file); - if no usable icon is found there, asks Google's favicon service: https://www.google.com/s2/favicons?domain=<domain>&sz=128 which sends Google the website's domain name (for example "fabfilter.com"). These requests carry the User-Agent "LicenseTracker-IconFetch/1.0". They do not include any license key, account data or other vault contents. Requests to private or local network addresses are refused. Nothing else is sent. In particular: - there is no telemetry, analytics, crash reporting or usage tracking; - there is no account and no cloud sync; - license keys are checked on your computer, without contacting the publisher; - receipt parsing (pasted text and dropped .eml, .msg, .pdf, .txt and .html files) happens entirely on your computer. Links you open from the program (for example "Buy" or a release page) open in your web browser and are subject to the privacy policy of the site you visit. 4. THE SOFTWARE SCANNER When you run the scanner, it reads, on your computer only: - the Windows "installed programs" lists in the registry (HKLM and HKCU ...\Microsoft\Windows\CurrentVersion\Uninstall, including the 32-bit view), and the VST plug-in path settings; - the list of installed Microsoft Store (AppX) packages; - standard plug-in folders (VST3, VST2, CLAP, AAX under Program Files and Common Files) and any folder you point it at, reading plug-in and program files to identify them. The results (names, publishers, versions, install paths, icons) are stored in your encrypted vault. Nothing is sent anywhere. 5. YOUR CHOICES - Turn off the update check with LICENSETRACKER_UPDATE_CHECK=off. - Do not use icon fetching; you can upload icons by hand instead. - Export your data at any time (Settings > Export). 6. DELETING EVERYTHING Uninstalling the program does not delete your data, so that a reinstall or upgrade does not lose it. To remove all data: 1. Quit License Tracker (tray icon > Quit). 2. Uninstall it from Windows Settings > Apps. 3. Delete the folder %APPDATA%\License Tracker (this deletes your vault, snapshots and license key). 4. Delete the folder %LOCALAPPDATA%\License Tracker (logs). 5. If you used the "lt" tool, delete the folder %USERPROFILE%\.licensetracker 6. Delete any export files and copies you made elsewhere. Deleted files may stay in the Recycle Bin until you empty it. 7. CHILDREN The program is not directed at children and collects no data about anyone. 8. CHANGES If this statement changes, the new version ships with the program and is published on https://licensetracker.danewagenhoffer.com. 9. CONTACT Dane Wagenhoffer https://licensetracker.danewagenhoffer.com support@licensetracker.danewagenhoffer.com