TDFby DOSAYGO Downloads

Privacy · Updated 24 July 2026

Local-first does not mean
risk-free.

A TDF can contain the same private information you saw in the browser. Know what is preserved, and review every collection before sharing it.

Local-first model

Grower writes collections to local `.tdf` files. Player opens those files locally. No hosted TDF account or first-party collection server is required for capture or replay.

You decide where the file is stored, backed up, and shared. Any cloud-sync service, messaging service, backup provider, or file host you choose has its own privacy policy.

What a TDF currently preserves

DataCurrent behaviorSharing risk
Response bodiesPreserved for captured resources.May include account pages, personal data, inline configuration, or secrets returned by a site.
Response headersKnown credential-bearing headers such as Set-Cookie, Authorization, and common API-key headers are removed before storage.Unrecognized headers can still contain identifying or private values.
URLsUser information and known authentication query parameters are removed before URLs become archive keys.Other query values can still contain email addresses, IDs, search terms, signed values with unfamiliar names, or private data.
Page titles and annotationsStored in the archive.May disclose research topics, identities, or curator notes.
Request headersNot archived as general metadata. Range information can affect the stored request key.Authorization and Cookie request headers are not intentionally stored, but equivalent secrets may still appear in URLs or response content.

What is not captured as browser storage

Grower is response-oriented. It does not currently export the browser's cookie jar, local storage database, session storage database, IndexedDB database, password manager, or browser history as separate archive objects.

This is not a guarantee that values from those stores are absent. A page can render or return them in captured URLs, headers, HTML, JSON, or scripts.

Redaction status

Redaction is best-effort, not a safety guarantee.

Grower removes known credential headers, user information and known secret parameters in URLs, and recognizable secrets in textual response bodies up to 16 MiB. Binary, oversized, non-UTF-8, encrypted, encoded, or unfamiliar secret forms may remain.

Open Privacy Review in Grower before sharing. Its archive report counts URL, header, and body interventions; identifies affected origins; and reports text bodies that could not be scanned. The report records categories and counts, not the removed secret values.

Treat authenticated captures as private unless you have reviewed the complete collection and can tolerate every preserved page becoming public.

Before sharing a collection

  1. Prefer a clean browser profile with only the account access needed for the collection.
  2. Close unrelated tabs and avoid capturing account settings, billing, inbox, admin, or token-management pages.
  3. Open Privacy Review and resolve every skipped body scan before public sharing.
  4. Inspect every page in Player while offline.
  5. Check page URLs for tokens, email addresses, identifiers, private search terms, and signed query strings.
  6. Do not share an authenticated collection publicly unless you can tolerate every captured page becoming public.
  7. Use archive encryption for storage and transport when the collection is sensitive. Encryption does not make an unsafe public share safe.

Grower license activation

Activation sends the unbound license token, device public key, derived device ID, server nonce, nonce signature, and product identifier to the DOSAYGO license service. The activated token is stored locally and checked offline during routine use.

Questions or deletion requests relating to license-service data can be sent to support@dosaygo.com.