Your account, your license, and your data

What it does: two separate things people assume are one. Your LICENSE lives in your account; your DATA lives on this machine and is never uploaded — so a new sign-in gets your license back, never your data.

Your license: signing in emails you a one-time code; that code proves the email is yours, and the answer that comes back is a signed note of your tier — free, trial or pro — and when it expires. Nothing about you or your network.

Your data: it lives on this machine, in the app's data folder (%APPDATA%\SubnetSlinger as the app sees it; under the Store install Windows keeps it in %LOCALAPPDATA%\Packages\AISMITHPDX.SubnetSlinger_…\LocalCache\Roaming\SubnetSlinger) and Documents\SubnetSlinger. It is never uploaded. Not the inventory, not the incidents, not the activity log, not runbooks, saved hosts, topology maps, captures, or the Vault.

Which means a new sign-in code gets your LICENSE back, never your data. Sign in on a new laptop and Pro unlocks on an EMPTY app. Your findings didn't travel — they were never anywhere but the old machine.

What this means in practice:

• No cloud sync. Nothing of yours lives on our servers to sync FROM. But you can make your own portable backup — File ▸ Back up & restore your work — and carry it to a new machine. See the "Back up & restore your work" article.
• If the machine dies with no backup, the data dies with it. There is no "restore from your account" — your account has never held it. Make a backup before you need one.
• The VAULT is stricter still. On Windows its passphrase is sealed to this Windows user and machine (DPAPI) by default, so copying vault.json elsewhere fails even WITH the right passphrase — a stolen bound file is useless. The recovery code you were shown at setup is the other way in (it's never device-bound); lose the machine AND that code and those secrets are gone. Keep anything you can't re-create somewhere else too.
• Anyone who can read your inbox can request a code and claim your LICENSE. They still get none of your data. Protect the mailbox.

What we collect

The whole list, not the highlights:

• Your email address — the license is attached to it, and the sign-in code proves the address is yours.
• An account ID — a random UUID. It's what the app actually asks about; the email is just how you sign in.
• Your tier and trial start date — so "is this Pro?" has an answer, and a 30-day trial knows when it began.
• A purchase record if you buy — the Stripe checkout ID, amount, currency, date and your billing country (for sales tax). Never your card.
• A sign-in session record — the IP address and app or browser each sign-in came from, so you stay signed in securely. It's removed when the session is signed out or your account is deleted.

That is the entire list. Your email is personal data and we won't pretend otherwise — it's how a license is yours and not someone else's.

What we never ask for or store

Not "we keep it safe" — we never have it:

• No card number, expiry or CVV. Buying opens Stripe in your browser; the card is typed on Stripe's page and we receive a purchase record (checkout ID, amount, currency, date, billing country) — never your card. There is no card field anywhere in this app.
• No Social Security or national ID number. No passport or driver's license number.
• No date of birth. No home address. No phone number.
• No name — unless your email happens to contain one.
• No password. There isn't one to steal: sign-in is a one-time code, so there's no password of yours in our database, and no password of yours to reuse anywhere else.
• No employer, job title, or company details.

A license needs to know WHICH ACCOUNT paid, not WHO you are. Anything beyond that would just be a liability to hold, so we don't hold it.

Why so little

Every field you collect is a field that can leak. The smallest set that makes licensing work is an email and an ID — so that's the set. It also means a breach of our database exposes a list of email addresses, tiers and sign-in IP addresses. Bad, but survivable, and nothing about your network is in there to expose.

How it's used

Only to answer one question: what does this account own? Your email is used to send you a sign-in code (Stripe emails your receipt). It is NOT sold, NOT shared with advertisers, NOT used for tracking or profiling, and NOT used for marketing you didn't ask for. There is NO telemetry, NO analytics, NO usage tracking, and no way for us to see what you scanned, found, or ran — not because we promise not to look, but because it never reaches us.

Some other things do leave the machine, because a tool can't answer a question about the internet without asking the internet. Being straight about these beats a slogan you'd disprove with a packet capture:

• Home / IP info can show your public IP, ISP and city by asking ipwho.is — but ONLY when you click to reveal it. It never runs on its own: Home opens with that panel blank until you ask. (The IP info tool is the same on-demand call.)
• DNS lookup asks the DNS server(s) set on THIS machine's network adapters by default, so nothing new leaves. Only if you tick "Use Cloudflare DoH (public)" does the name go over HTTPS to Cloudflare, which then sees it.
• The Home speed test downloads from and uploads to Cloudflare's speed.cloudflare.com — only when you click Run. It sends throughput test bytes, nothing about you.
• WHOIS/RDAP goes to rdap.org — it sees the domain or IP you asked about.
• MAC vendors come from the offline table bundled with the app. For a vendor prefix it doesn't know, only the 3-byte VENDOR prefix goes to api.macvendors.com — never the full MAC, never the device. That happens when you look a MAC up in the MAC / OUI tool, run a runbook's MAC/OUI step, or the Deputy / MCP server runs mac_lookup (each labelled on screen), and in the ARP table or a Discovery / Topology sweep only when you click or tick "Look up unknown vendors online".
• Opening the Deputy (or pressing ↻, or switching provider) with a cloud provider selected asks that provider for its model list with your key and reads model prices from subnetslinger.com/models.json — no chat data. A cloud Posse run reads the same file. With Ollama it doesn't.
• Field Kit checks you run: Wall jack and Captive portal probe Google (connectivitycheck.gstatic.com), Wall jack also pings Cloudflare (1.1.1.1), and Network Experience pings Cloudflare (1.1.1.1 and its IPv6 resolver) every 5 s while it runs. Each names its destination on screen, and none runs until you press Run / Check / Start.
• NTP check starts on pool.ntp.org (change it to your own server). The built-in runbooks reach google.com, www.google.com and 8.8.8.8, and some tools open pre-filled (example.com, cloudflare.com, 8.8.8.8 or 1.1.1.1 when no gateway is found) — only when you press Run.
• The Deputy and Posse send your question and the tool results to the cloud AI provider you pick — Anthropic, an OpenAI-compatible endpoint, or Google Gemini — ONLY if you choose it and supply your own key; you're billed by that provider directly, and secret-shaped text is stripped before it goes. A badge by Send says where it goes, and before a message or a Posse run leaves, a WARNING names the provider and what the redactor removed — you click Send (tick "Don't ask again for this destination" if you want it to stop asking). Connecting a third-party MCP server asks the same way. Demo mode never sends. Switch the provider to Ollama on this machine and the whole thing runs locally: nothing leaves at all (no model list or prices from subnetslinger.com either). An Ollama host on another machine gets the same WARNING as a cloud AI.
• Ping, trace, port scans, SNMP and the rest talk to whatever target YOU point them at. That's the tool doing its job.

The one licensing call

When you open the Account screen (or press Refresh there — do that after paying), a signed-in app (any tier) verifies its own license with our licensing backend — it sends the auth token and gets back what you own, never your network data. The app makes no licensing call at launch, with one exception: after you update from a 1.2 version it checks at launch, and repeats at each later launch (up to 10 tries) until it gets an answer (next paragraph). Otherwise it trusts the signed license cached on this machine: Pro keeps working offline for 30 days from the last check; a trial needs a check at least every 14 days.

Updating from an older version

After you update from 1.2, connect once: open Account while online and press Refresh (a signed-in app also tries in the background at each launch, up to 10 tries, until the licensing service answers). A license saved by version 1.2 has no signed proof, so it can't be honored offline until then — the app runs Free and Home and Account say so. That one check carries Pro over, and from then on the 30-day offline grace applies.

A FREE-TIER user with no account makes ZERO automatic outbound calls, unless you run a tool or open the Deputy with a cloud provider selected (it reads the model list and prices from subnetslinger.com/models.json; with Ollama it doesn't). Want none of anything? Stay on the free tier and don't open the Deputy with a cloud provider: the app then talks to nothing but the network you point it at. (Live Deputy and Posse answers — with any provider, Ollama included — need Pro or the trial; the free tier plays the built-in sample investigations.)