Dataset boundary
Filesystem access, detection, parsing and queries run in the desktop Rust engine. Account services handle email, billing state and device activation. Original dataset files and paths are not part of the activation protocol.
Trust through clear boundaries
Your data stays local.
Your access stays explicit.
Local data processing, account services and AI integrations have different responsibilities. Here is where each boundary sits.
MCP boundary
MCP authorization constrains local access independently of Pro licensing. Results go to the client you connect, so that client's storage and model-provider policies apply.
Account boundary
Email codes are short-lived and single-use. The browser uses an HttpOnly session cookie. Desktop session credentials are stored in Windows Credential Manager or macOS Keychain; Account credentials remain in native protected storage.
License boundary
Pro uses server-signed, device-bound Ed25519 entitlements. The signing private key stays server-side. Offline leases are bounded and never extend beyond the paid period. Three active installations can be managed from Account.
Payment boundary
Paddle handles checkout and billing. Browser success messages do not unlock Pro. The backend verifies notifications and reads provider state; full approved refunds revoke the affected purchase.
Honest offline limits
An offline computer cannot receive an immediate refund or device-revocation update. Access ends within the signed license's bounded lifetime. Local software also cannot promise perfect resistance to a determined administrator modifying its binary.