Local-first model
Grower writes collections to local `.tdf` files. Player opens those files locally. No hosted TDF account or first-party collection server is required for capture or replay.
You decide where the file is stored, backed up, and shared. Any cloud-sync service, messaging service, backup provider, or file host you choose has its own privacy policy.
What a TDF currently preserves
| Data | Current behavior | Sharing risk |
|---|---|---|
| Response bodies | Stored exactly as the browser received them. Tree never edits a page, script or data file. | May include account pages, personal data, inline configuration, or secrets returned by a site. |
| Response headers | Stored as the browser received them when they are part of a captured response. Tree may inspect a bounded set of header and cookie names to warn about likely signed-in activity, but it does not remove or replace their stored values. | Headers can contain session, account, identifying, or private values even when they are not visible on the rendered page. |
| URLs | Stored with their browser-observed values so the captured page has the same request identity during replay. | URLs can contain tokens, email addresses, IDs, search terms, signed values, or other private data. |
| Page titles and annotations | Stored in the archive. | May disclose research topics, identities, or curator notes. |
| Request headers | Not archived as general metadata. Range information can affect the stored request key. | Authorization and Cookie request headers are not intentionally stored, but equivalent secrets may still appear in URLs or response content. |
What is not captured as browser storage
Grower is response-oriented. It does not currently export the browser's cookie jar, local storage database, session storage database, IndexedDB database, password manager, or browser history as separate archive objects.
This is not a guarantee that values from those stores are absent. A page can render or return them in captured URLs, headers, HTML, JSON, or scripts.
What Grower warns about
Grower preserves captured URLs and response-header values for replay. It does not remove or replace likely private values. Instead, it can warn when a bounded set of header or cookie names suggests that a page may have been captured while signed in.
Grower does not inspect or change page contents. A page, script, image or data file is stored exactly as the site sent it. If that content contains private information, the private information stays in the archive.
Privacy Review looks only at a limited number of header and cookie names to warn that signed-in activity occurred. It does not keep their values. It ignores ordinary analytics and advertising cookie names. An outside resource creates a warning only when its own headers clearly indicate a sign-in or session.
Versions before 2.1 replaced recognised secrets in textual bodies with [REDACTED], and 2.1 replaced selected URL and response-header values. Those changes could break replay. Archives made by those versions keep their replacements; Tree 2.2 does not make new replacements.
Open Privacy Review in Grower to see whether limited header-name checks suggest signed-in activity and which page origins may be affected. The report does not display passwords, cookies, tokens, or other credential values. If you were not signed in, the warning may be a false alarm. You can suppress future automatic reminders and still open Privacy Review manually.
Privacy Scan is not currently offered in the Grower menu. Its experimental offline implementation is retained for possible future work, including explicit remedial actions, but Tree 2.2 does not present it as a protection users should rely on.
You choose what to capture, retain, back up and share. A TDF can remain a private working archive. Treat a signed-in capture as private. Password protection encrypts the whole TDF so only someone with the password can open it; use it for private storage, backups, or controlled sharing. It controls access to the file but does not remove sensitive material after the file is opened.
Grower license activation
Activation sends the unbound license token, device public key, derived device ID, server nonce, nonce signature, and product identifier to the DOSAYGO license service. The activated token is stored locally and checked offline during routine use.
Grower also sends its activated token and a version number to the license service when it checks whether an update is included in your subscription, and to refresh its token after a renewal. Both applications check the TDF release location (trees.dosaygo.com, with GitHub as a fallback) for new versions, and may query a public time server to check the device clock. None of these requests include your browsing, captures, or collections.
Grower sends the same token and device proof when you deactivate a computer, and renews its license with the service at least every 60 days while online. For each activation the service keeps its device ID and public key, the activation time, and the time and network (IP) address of its most recent renewal, which it uses to detect copied activations. The device ID is derived from a key on your device, so we treat it as information about that device, not as anonymous.
When you buy Grower we keep your email address, license and subscription dates, the EULA version and checkout statements you accepted and when, and Stripe customer, subscription, and payment identifiers. Stripe processes your payment; we never receive your full card number. We keep these records for as long as the license exists and afterwards as long as needed for billing records, tax and legal obligations, disputes, and fraud prevention.
Our service providers are Stripe (payments), Mailjet (license emails), Hetzner (license service hosting), Cloudflare (this website and release downloads), and GitHub (release downloads). We do not sell personal information.
This privacy notice is provided by DOSAYGO, a Wyoming corporation, 9450 SW Gemini Dr #44162, Beaverton, OR 97008-7105, USA ("DOSAYGO"). Questions, or requests to access, correct, or delete license-service data where the law provides that right, can be sent to support@dosaygo.com.