Privacy

What we collect

The whole list: your email address, a random account ID, your tier, and when your trial started. If you buy, we also keep a purchase record: the Stripe checkout ID, amount, currency, date, and your billing country (for sales tax). Each sign-in also leaves a session record at our licensing provider (Supabase): the IP address and the app or browser it came from, so you stay signed in securely.

The email is how we know a license is yours and not someone else's. It's personal data and we're not going to dress it up as anything else.

Stripe collects your card, email and billing details on its own page, under Stripe's privacy policy. The app gives Stripe only your random account ID, so the payment reaches your account. Stripe emails your receipt. That's everything.

The free tier needs no account at all. Nothing is sent for licensing until you start a trial or buy.

What we never ask for

Not "we keep it safe." We never have it:

• No card details. Buying opens Stripe in your browser. The card is typed on Stripe's page, and we receive only the purchase record above, never your card number. There is no card field anywhere in the app.
• No Social Security or national ID number. No passport or driver's license number.
• No date of birth. No home address (Stripe collects billing details for tax on its own page; we keep only the country). No phone number.
• No password — there isn't one. Sign-in is a one-time emailed code, so there's no password of yours in our database, and none to be reused against you somewhere else.
• No name, unless your email happens to contain one.
• No employer, job title, or company details.

A license needs to know which account paid, not who you are. Anything more would be a liability for us to hold, so we don't hold it. If our database ever leaked, it would spill a list of email addresses, license tiers and sign-in IP addresses. Bad — but nothing about your network is in there to spill.

What the tools talk to

A tool can't answer a question about the internet without asking the internet. Nothing here is automatic — each one runs because you ran it:

All but the model-list refresh run straight from your machine to a third party and never route through us — we don't see them, log them, or receive them. The model-list refresh is the one that reaches us, and it's a plain read: a static list of models and prices, with nothing about you or your network in the request. Our web host may log it as an ordinary page visit (see the website analytics note below); the app sends no question, no data, and no account with it.

The one thing Home checks by itself is your own default gateway — a ping to your own LAN, to answer "is my network up?" It never reaches the internet, and if there's no gateway it says so rather than quietly pinging someone else's server to find out.

On macOS

These same lookups use different services on the Mac:

• Home's Public IP card: api.ipify.org (and ipapi.co for ISP and city), only when you click Reveal.
• IP info tool: 1.1.1.1/cdn-cgi/trace, with api.ipify.org and icanhazip.com as fallbacks.
• DNS lookup tool screen: DNS-over-HTTPS to the resolver you pick (cloudflare-dns.com, dns.google, or dns.quad9.net), and it says so.
• WHOIS: the registry's own server on TCP port 43.
• Field Kit captive-portal check: captive.apple.com.
• Check for Updates… (SubnetSlinger menu): reads subnetslinger.com/appcast.xml only when you choose it — never at launch or in the background. Like the model list, that one request reaches us.
• MAC vendors: the table is built in, so there's no vendor-lookup call.
• "Is my network up?" is answered from the operating system's own network-path monitor rather than by pinging your gateway.

What changed on macOS in 1.3:

• Menu-bar gateway probe: now off by default. It pings your gateway only if you turn on "Probe gateway every 15 s".
• DNS from the Deputy and the MCP server (dns_query): uses your Mac's own DNS resolver by default. DNS-over-HTTPS (Cloudflare, Google or Quad9) is used only when one is asked for by name. The DNS lookup tool screen is unchanged: it still uses DNS-over-HTTPS and says so.
• ARP table and Discovery's MAC lookup: read from your Mac's own kernel table. No network traffic.
• HTTP / API tool: Authorization, Cookie and API-key headers are not forwarded when a redirect changes the host, scheme or port.

Otherwise the macOS endpoint list is unchanged from 1.2.0.

AI features (Deputy / Posse)

If you turn on the optional AI features and choose a cloud provider, your question plus any relevant read-only diagnostic output (which can include IP addresses, hostnames, and similar network data) is sent directly from your machine to that provider — Anthropic, OpenAI (or an OpenAI-compatible endpoint you set), or Google Gemini — using an API key you supply yourself, never to us. Before anything is sent to the cloud, SubnetSlinger scans your message and the tool output for secret-shaped text — private keys, password fields, auth tokens, API keys — and strips it out first. This is a pattern match, not a guarantee: it catches well-known secret shapes, not everything a person could type, so don't rely on it if you're pasting something you consider truly sensitive — use the local Ollama option instead for that conversation. Before a cloud message, a Posse run or a new MCP connection leaves, a WARNING names the provider and what the redactor removed. Demo mode never sends. On macOS, the first send to each provider and host asks once, "Send to <host>?", for Chat, Explain and the Posse alike. You can instead choose a local model via Ollama so your questions and answers never leave your machine — an Ollama server on another machine is an outbound connection, and the macOS app labels it that way. Either way, the AI tools are read-only by default and don't change device configuration — the one exception is a third-party MCP server you connect and deliberately switch to "writes" (off by default).

MCP servers you connect

If you connect a third-party MCP server (MCP servers screen, used by the Deputy), that connection and any data it sees is between your machine and that server — a trust decision you make per server, not something we operate or see.

Credential Vault

Passwords and other secrets you store in the Vault are encrypted on your machine (AES-256-GCM) and are never transmitted anywhere by the app.

Your passphrase is what unlocks it — without it, the secrets can't be read, by us or by anyone. How portable the encrypted Vault file is depends on your OS. On Windows the passphrase is bound to this device by default (you can turn that off), so a copied vault won't open elsewhere with the passphrase — only with the recovery code you were shown at setup, which is never device-bound. Keep that code safe. On macOS the secrets live in the Mac's data-protection Keychain, on this device only, and are not included in Backup export (.slinger), Time Machine, Migration Assistant or iCloud (on a new Mac you re-enter them). On Linux it's a passphrase-protected file you can move yourself. Keep your passphrase safe, and keep a copy of anything you can't re-create somewhere else as well.

Your data doesn't follow your license — you carry it

Sign in on a new computer and your Pro license unlocks — on an empty app. There's no cloud sync and no "restore from your account": your account has never held any of your data. It lives on your machine, and only there.

So bring it across yourself. Back up & restore (in the app's File menu) saves your work — inventory, incidents, runbooks, saved maps, watch lists, projects, custom themes, saved hosts, SSH quick commands, MCP server setups and the activity log — to a single file (.ssbackup on Windows and Linux, .slinger on macOS) you can move to a new machine and import. It's your file: keep it on a USB stick, a file share, your own cloud drive, wherever you like. We never see it, and it never touches our servers.

The backup leaves out three things on purpose.

Your Vault secrets aren't in the app's backup file, on any desktop. How the Vault itself moves (or doesn't) is under Credential Vault above — on a new machine, move it that way or set your secrets up again.

Your saved SSH host keys don't come across either. Those are the fingerprints the app uses to recognize each server you connect to. On a new computer you want to confirm each server's fingerprint yourself the first time you connect — that's how you'd catch an impostor pretending to be a server you trust. Trusting a copied list would skip that check, so leaving them out is a safety feature, not a loss.

Your license isn't in the backup, and doesn't need to be. Sign in on the new machine and Pro turns back on.

Website

Our hosting provider may collect basic visit analytics on subnetslinger.com (page views, referrer). We do not use ad trackers or sell visitor data.

Account & licensing

When you sign in to activate a Pro license, we store your email address, your license status and the other records listed in What we collect (account ID, trial dates, purchase record, sign-in records) in our licensing service (hosted by Supabase). Payment processing is handled by Stripe (a Stripe Payment Link on buy.stripe.com, opened in your browser); we receive the purchase record above, never your card number, and the app passes Stripe only your random account ID so the payment reaches your account. Your email is used to send you a sign-in code (Stripe emails your receipt) — it is not sold, not shared with advertisers, and not used for tracking, profiling, or marketing you didn't ask for.

If you're signed in — on any tier, free, trial or Pro — the app checks your license with this service when you open the Account screen; on Windows and Linux, the first launch after you upgrade to 1.3 also runs a one-time check, repeating at each launch until the licensing service answers (up to 10 launches), and never in demo mode. On macOS 1.3 the check also runs silently at launch, or when the app comes to the front, only when all of these hold: you're signed in, demo mode is off, it's been 12 hours or more since the last try, and your license is due. "Due" means 7 days or fewer of the 30-day offline grace are left, the license has lapsed, it has never been verified on this Mac, or a trial is 2 days or less from its end. The Mac also refreshes once the first time you open Account in each session, and a failed check retries at the next online launch. It sends only your sign-in token, with no device details, app version, or network data, and gets back your tier. If the call fails, the app keeps using your cached license, so it still works offline. A user who never signs in makes no licensing call at all.

You can delete your account on the account deletion page or by emailing sheriff@subnetslinger.com.

Phone and tablet apps (Android, iPhone, iPad)

The Android app is live on Google Play; the iPhone and iPad apps are in App Store review. This page is the privacy policy for all of them.

• They're free companions for everyone. There's nothing to buy inside them, so they never ask for card or payment details.
• No account. None of the phone or tablet apps has a sign-in, and none talks to our licensing service.
• No analytics. No analytics, crash-reporting or ad code. Each tool contacts only the address you point it at, when you run it.
• Background. On Android, Monitor keeps checking the hosts you chose in the background until you stop it. It shows a notification while it runs and stops after 12 hours. On iPhone and iPad, nothing runs in the background: tools work only while the app is open.
• AI (optional). If you turn on the Deputy or Posse with a cloud provider, your question and the tool results go from your phone straight to that provider (Anthropic, an OpenAI-compatible endpoint, or Google Gemini) under your own key, never to us. Secret-shaped text is stripped first. With your own Ollama host, they go only to that host. To list the models, the app asks your provider with your key, or downloads the public list at subnetslinger.com/models.json.
• Permissions. On Android, Wi-Fi scan and Radio info read nearby access points and cell details, which needs the location permission. On iPhone and iPad, the apps ask for Local Network access (to reach devices on your network) and, only if you turn on reminders or alerts, Notifications. No location, camera, microphone, contacts or photos. What the tools find stays on your device.

How long we keep it

• Account data (email, account ID, tier, trial dates): kept while your account exists, and deleted within 30 days of a deletion request.
• Sign-in sessions (IP address, app or browser): kept until the session is signed out, and deleted with your account.
• Purchase records (checkout ID, amount, currency, date, billing country — no email, name or address): kept for 10 years for tax and accounting, then deleted. If you delete your account, the record is detached from it.
• Contact and feedback submissions: deleted once we've handled them, and at most after 12 months.
• Reviews: an approved review stays on the site until you ask us to remove it; a review we don't approve is deleted after 90 days.
• Website visit logs: kept by our web host, Vercel, only for its standard short log window, then deleted automatically. We don't export or keep them.
• Everything the app stores on your machine stays until you delete it — uninstall the app or clear its data folder. We never had a copy.

To delete your account, use the account deletion page.

Who processes it

• Vercel — hosts this website (and may log visits; see Website above).
• Cloudflare — hosts the download files on dl.subnetslinger.com.
• Supabase — accounts, licensing and the website forms.
• Stripe — payments and receipts.

Cloud AI providers (Anthropic, OpenAI-compatible endpoints, Google Gemini) are your own relationship, under your own key — that traffic goes from your machine to them, never through us. The internet lookups in the table above go straight from your machine to those services too.