Privacy Policy

Last updated: October 18, 2026

In one sentence: LumePane has no telemetry and no analytics in the app. The app bundles no analytics SDK and never reports how you use it. Our licence service does keep a handful of aggregate counters — described in the next paragraph, and the only thing here that could be called analytics.

The counters we keep. The licence service counts six events: a checkout click, an order created, an order paid, a code claimed, a success page served, and a short code redeemed — per day and per ?src= campaign tag. The counters contain no identifier: no IP address, no cookie, no device id, nothing that could be linked to a person. They exist so we can tell which channel is worth the effort.

Abuse protection is separate. Requests to the order, success and retrieval pages are rate-limited. The rate-limit keys use a truncated SHA-256 of the client IP address and expire automatically: about 15 minutes for the success and retrieval pages, and 10 minutes for activation. Retrieval attempts also write an audit row containing that truncated hash, a truncated hash of the order id and the outcome; the row is kept for up to 30 days so abuse can be investigated. Rate-limit keys and audit rows are not part of the aggregate counters above.

1. What we collect

No usage data at all about you. No analytics, no event reporting, no crash-report uploads, no device fingerprinting, no advertising identifiers, no user profiling.

Licensing contacts the network in two situations: the one-time redemption of a short code (DP-XXXX-XXXX-XXXX), and the one-time device registration on first activation. Short-code redemption sends exactly two things:

Device registration: after an activation code verifies, the app contacts our own server once to register this Mac — it uploads only an irreversible SHA-256 digest computed locally from the board identifier and the model identifier, never a serial number or plaintext model string. The digest is stable for a given Mac, which is what makes the five-Mac limit enforceable; it is pseudonymous, not anonymous. After that, every launch is verified locally.

• The short code — the 12-character code shown on the order page after payment;
• A randomly generated device identifier — created locally as a UUID the first time you redeem a short code, and stored in the macOS Keychain. It is used for short-code redemption and for binding the local licence record. It contains no hardware serial number, MAC address, display EDID, machine name, Apple ID, or account information.

That request only asks the licensing service to exchange the short code for the long signed activation code belonging to that order. A code beginning with DP- (the long signed code) is then verified entirely offline with the public key embedded in the app. On first activation the app also registers this Mac once, as described above; after that, every launch is verified locally. The random identifier cannot be traced back to your device model.

Current status: checkout is live. Payment is in cryptocurrency through our own checkout and licensing service. A DP- activation code is verified offline. Two things use the licensing network: redeeming a short code, and registering the device on first activation. Both go to our own service, never to a third party.

2. What we don't collect

These are things the app uses but processes only locally on your Mac. They are never uploaded:

• display model, vendor ID, product ID, the full EDID, and physical color gamut;
• resolution, refresh rate, the current gamma table, brightness, and color temperature values;
• disk capacity, cache directory sizes, scan results, and cleanup records;
• window titles and positions (needed for window layout and session restore; readable only after you grant Accessibility permission);
• scroll wheel events and hotkey keystrokes (needed for scroll smoothing and mouse mapping).

And these we never touch at all:

• we don't upload your display model, EDID, or serial number — no such code path exists;
• we don't upload session length, feature click counts, or launch counts;
• we don't record keystrokes. Scroll smoothing reads only the displacement of scroll-wheel events; the keyboard is used solely to determine the single state “⌘ is held, bypass smoothing”;
• we don't request microphone, screen recording, or Full Disk Access permission. Storage scanning is read-only, and system-protected directories are skipped according to macOS rules;
• we don't capture screen or audio. There is no camera or microphone call anywhere in the app. (Info.plist carries no NS*UsageDescription keys at all.)

3. Only three things reach the network

Apart from the three items below, the app initiates no network requests. Everything is HTTPS; plaintext HTTP is never used.

1. Checking for updates

The app requests a version manifest from appcast.xml to see whether a newer version exists. That manifest is hosted alongside this website on GitHub Pages. The request contains no license key, no device identifier, and no usage data. It is off by default: it is only sent if you turn on automatic checking in the General panel (at most once a day thereafter), or click “Check for Updates” yourself.

The host, GitHub, sees your IP address, the request time, and a client identifier, exactly as any web server would. That is the host's ordinary access log, not something we collect on top of it.

2. Verifying a license

This only happens when you activate. A long signed code (DP-…) is verified locally, offline, with a public key built into the app — its verification never sends a request. A short code (DP-XXXX-XXXX-XXXX) is exchanged once, at redemption, with our own licensing service:

• Redeeming a short code: sends the short code plus the random device identifier described above, and receives the long signed code back;
• Registering this Mac: on first activation, sends the code plus the locally computed device digest once, so a long code can be limited to five Macs; the same code on the same Mac is recognised and does not consume a second slot;
• Long signed code: verified offline with the embedded public key. No account, no server, no periodic phone-home — the license never lapses because you were offline.

We have deliberately made this offline-first: a failed re-check, a dropped connection, or a server outage never changes your license state — it only records an error. If re-checks can't get through for a long time, there is still a 7-day grace period during which everything keeps working. Until you activate, the app sends no license request at all and asks for no account.

Current status: this is live. A long DP- code is verified offline. The only licensing requests are the one-time device registration on first activation and, if you use one, the short-code redemption above; both go to our own service. Until you activate, the app sends no license request at all and asks for no account.

3. Opening the purchase page or the website

When you click “Buy” or “Visit website”, the address opens in your default browser. Payment happens in your browser, not through the app. The purchase entry point is the order page served by our licensing service; it uses the browser you already have and installs nothing.

4. Where your data lives

• License record (license key, instance ID, activation and re-check times): the macOS Keychain, under the service name com.neeson.displaypilot.license. Not a plaintext plist.
• App settings (trial start date, interface preferences, hotkey bindings, automation rules, eye-care schedule): ~/Library/Preferences/com.neeson.displaypilot.plist.
• Cleanup quarantine and operation log: ~/Library/Application Support/com.neeson.displaypilot/Clean/. Files are moved into quarantine here first, stay restorable, and permanent deletion is only offered after 30 days.
• System permissions: Accessibility authorization is managed by macOS and can be revoked at any time in System Settings → Privacy & Security → Accessibility.

To remove everything: quit the app, then delete the two directories/files above; for a thorough job, also delete that one Keychain entry in Keychain Access. The app installs no background service or daemon, and uninstalling leaves no resident component behind.

5. Third parties

• Our licensing service (Cloudflare Workers): serves the order page, matches your payment against the blockchain, issues the activation code, and answers a short-code redemption. It sees the order number, the on-chain transaction hash and amount, and — depending on the path — a random device identifier (short-code redemption) or the one-time device digest (activation); it does not see your name or account, and it keeps no profile of you. If you buy through a channel that collects an email address, or if you use the recovery form, it also handles that address: stored with the order record (which we keep, so that recovery keeps working) so your code can be re-sent, and a truncated SHA-256 hash of it is stored and embedded in the signed code so the form can match your order without comparing raw addresses.
• Public blockchain APIs (for example TronGrid and public RPC endpoints): the licensing service reads public chain data to confirm your transfer. No personal data is sent to them.
• GitHub: hosts this website, the update manifest, and the download. As the host it keeps ordinary access logs (IP address, time, request path).

Beyond these, the app and this website have no analytics service, ad network, social plugin, or third-party font.

6. Children

LumePane is a desktop tool for Mac users. It is not designed for children, and it does not knowingly collect any information from children.

7. Changes to this policy

If a future version changes the app's network behavior — for example, adding cloud sync — this policy will be updated first, and the changelog will say what changed. We will not quietly widen what we collect behind a “continued use means acceptance” clause.

8. Contact

If you have questions about this policy, or want to check which license information is held about you, please open an issue on GitHub.