Privacy and data: what Octoolo sends and where it keeps things

#Octoolo's privacy in short

• Your files never leave the PC. Octoolo opens, edits, converts and saves documents, photos, videos, sounds, recordings and archives on the computer. It has no cloud storage and uploads no file to work on it. AI features and the translator run on the PC.
• What Octoolo does send, and only to the places named here: update checks (octoolo.com), usage statistics without your name or email (octoolo.com, can be turned off), Octoolo Cloud license checks (octoolo.com, only once the subscription is turned on), Help and feedback messages (octoolo.com, only when you send one), password leak checks (Have I Been Pwned, only when you ask), parts that download once when a tool first needs them (GitHub, Microsoft, Hugging Face, octoolo.com), and the files you give the download manager (from the sites they are on).
• No advertising. The statistics go to Octoolo's own server, not to analytics or advertising companies, and are not sold or shared.
• Settings > What leaves this computer lists the same in the app, and See what is sent shows the next usage statistics request exactly.

The privacy policy is at https://octoolo.com/privacy/ (see "Octoolo's privacy policy" below).

#Your files never leave the PC

No file you open in Octoolo, and none of its content, is sent anywhere: not to octoolo.com, not to an AI service, not to a converter website.

• Editing, converting, compressing, locking, playing and recording all happen on the PC.
• The AI tools (background removal, selection, object removal, upscaling, depth, the vocal remover) and the translator run on the PC's graphics card or processor. Only the model itself is downloaded, once.
• Image to text uses Windows' own text recognition, which runs on the PC.
• File names and folder paths are not sent either: the usage statistics and the errors sent with Help and feedback have names, paths, links and email addresses taken out.

The only things that go out with a file are what you choose: a message you write in Help and feedback (text only, no attachments) and the links you paste into the download manager.

#Update checks

• What: Octoolo asks https://octoolo.com/download/latest.json whether there is a newer version and, if there is, downloads the installer from octoolo.com.
• When: about 15 seconds after Octoolo starts, then every 4 hours while it runs; or only when you click Check now or the version tag, if Settings > Updates > Download new versions on their own is off.
• What goes with it: nothing about you, the PC or your files. As with any request on the internet, octoolo.com sees the PC's IP address.

Details: Install and update.

#Usage statistics: exactly what is sent

Octoolo counts how its apps are used, to learn which tools people use and which ones break. Each request to https://octoolo.com/api/v1/app/events carries:

Each event has a time and a name, and some have an app id, a task id, a number or a few words:

Never sent: files, file names, folder paths, the text you work on, passwords, your name or email.

The statistics themselves say nothing about who you are, but the random id can be tied to a person:

• Octoolo Cloud: when it is turned on, the PC is added to the subscriber's account with this id, so the team can see which apps the PCs on an account open.
• Help and feedback: a message sent with Include technical details on carries the id, so the team can see what that copy did next to the message (and the email, if one was given).

• How often: the first request about 30 seconds after Octoolo starts, then every 3 minutes, and only when something happened. Only Octoolo's main window counts.

• Offline: events wait (up to 2,000) and go with a later request. When Octoolo closes before they could be sent, they are kept in usage-queue.json in Octoolo's data folder and sent after the next start.

• Turning them off: Settings > What leaves this computer > Send anonymous usage statistics. Off means nothing more is collected or sent, and the events waiting are deleted at once. The first time the home screen opens, a note points to this switch.

• Seeing them: See what is sent, under the switch, shows the next request exactly as it would go, with the events waiting.

• On octoolo.com: the statistics are kept for about 13 months (privacy policy). The server also notes the country the request came from, worked out from the IP address; the IP address itself is not stored with the statistics. The team reads them in Octoolo's own admin panel.

#Octoolo Cloud license checks

Only once Octoolo Cloud is turned on on a PC (by a checkout started from the app, or a license key), Octoolo talks to https://octoolo.com/api/v1/app/license/...:

• When: when you turn it on; about 20 seconds after each start; every 6 hours while Octoolo runs; when you click Check now in Settings > Your plan; when you click Remove this PC; when you open Your account or Manage billing from the app (to sign you in on octoolo.com). While a checkout opened from the app is waiting in the browser, every 4 seconds for up to an hour.
• What goes with it: this copy's random id, the PC's name (Windows' computer name, so your PCs can be told apart in your account), Octoolo's and Windows' versions, a secret this PC was given when it was turned on, and, the first time, the license key you typed (or, while a checkout started from the app is waited for, that checkout's one-time link).
• What comes back: the subscription's state, plan and dates, and the account's email, signed by octoolo.com so Octoolo can check it offline. It is kept in license.json in Octoolo's data folder.
• The free apps never need these checks (which apps are free: Prices and limits).

Buying, the account page and billing open in the browser, on octoolo.com and Paddle's checkout. What the account holds and what Paddle collects: License and account, Plans and billing and the privacy policy.

#Help and feedback messages

When you click Send in Help and feedback, Octoolo sends to https://octoolo.com/api/v1/app/feedback:

• always: the kind of message, the app chosen, your text, your email if you gave one, and Octoolo's and Windows' versions;
• with Include technical details on (the default): the PC's total and free memory and number of processors, the screen size and scaling, the window size, the language and time zone, the view you were on (for example #/app/pdf), the last errors Octoolo showed (up to eight, with names and paths taken out), and this copy's random id, so the team can see which apps it used and what went wrong.

No files, screenshots or file names are sent; Help and feedback cannot attach them.

Afterwards, to show the team's replies, Octoolo asks octoolo.com for them a minute after each start, every 30 minutes, and when Help and feedback opens, with each conversation's number and its secret token (kept in feedback.json in Octoolo's data folder). It only asks when there are conversations. The server notes the country of the request, worked out from the IP address, with a message.

The team's replies show in Help and feedback; octoolo.com does not email them, even when an email address was given (the team may write to that address itself). Messages are kept with the team's answers so the team can follow up; to have yours deleted, write to hello@octoolo.com. More: Home screen and Settings.

#Password leak checks (Have I Been Pwned)

In the Passwords app, the password leak check and the health check's leak check ask Have I Been Pwned whether a password appeared in a data breach, without sending the password:

• Octoolo makes the password's SHA-1 fingerprint on the PC and sends only its first 5 characters to api.pwnedpasswords.com.
• The answer lists every leaked fingerprint that starts with those 5 characters (padded, so its size tells nothing), and Octoolo looks for a match on the PC. Have I Been Pwned cannot tell which password it was.
• This only happens when you click to check. Nothing else from the vault ever leaves the PC: the vault file is encrypted with your master password and stays in Octoolo's data folder.

See Passwords.

#Parts that download the first time a tool needs them

Some tools need a part that is not in the installer. Each downloads once, after you click its download button, is checked against its SHA-256 fingerprint, and then works offline:

Only the download request goes to these sites (with the PC's IP address, as any download). Your pictures, sounds and text are never sent. Microsoft's terms for DirectML, part of the AI runtime, say it may send usage data to Microsoft through Windows' diagnostic data settings (privacy policy).

When the PC has no WebView2, the Octoolo installer also downloads Microsoft's WebView2 installer from Microsoft. Sizes and details: Downloads on first use.

#The download manager

The Downloads app's download manager fetches the links you give it from the sites they point to, as a browser would. Those sites see the PC's IP address and a browser-like request naming Octoolo; nothing else is sent to them. Octoolo sends nothing about these downloads to octoolo.com, apart from the usage statistics' count that a tool was used. See Downloads.

#When Octoolo connects to the internet: a timeline

After Octoolo starts:

Only when you act: sending a message, a password leak check, a first-use download, the download manager, turning on Octoolo Cloud, Remove this PC, Check now, and links that open octoolo.com or Paddle in the browser.

#Using Octoolo offline

Octoolo works without an internet connection, apart from:

• the first download of FFmpeg, an AI model or a translator language;
• update checks, which wait and try again;
• Help and feedback (sending and fetching replies);
• password leak checks;
• the download manager;
• Octoolo Cloud: the paid apps keep working offline for a limited time after the last successful check (Prices and limits, License and account).

Usage statistics wait and go later. Firewalls that block octoolo.com stop updates, statistics, Help and feedback and the license checks, but not the apps themselves.

#Where Octoolo keeps data on the PC

Everything Octoolo keeps for you is in one folder, %LOCALAPPDATA%\com.octoolo.app (for example C:\Users\<name>\AppData\Local\com.octoolo.app). Type %LOCALAPPDATA%\com.octoolo.app in File Explorer's address bar to open it. Inside:

Octoolo itself is installed in %LOCALAPPDATA%\Octoolo by default (the program, not your data). The installer and uninstaller also know %APPDATA%\com.octoolo.app; this version of Octoolo keeps nothing of its own there.

#Files Octoolo writes outside its data folder

• Your results go where you choose in a Save dialog, or next to the original file.
• Screen recordings go to Videos\Octoolo unless another folder is chosen.
• Converted video and sound go next to the originals or to a folder you choose; when that folder (the original's or the chosen one) cannot be written to, to Videos\Octoolo or Music\Octoolo.
• Temporary files: %TEMP%\Octoolo\Opened holds copies of files opened from inside an archive (Files app), cleared after a day; installers that updates used (%TEMP%\Octoolo-<version>-updater-...) are deleted by Octoolo at its next start.
• Windows settings: File Explorer's right-click menu and "Open with" entries (under HKEY_CURRENT_USER\Software\Classes), and Start Octoolo when you sign in to Windows (Windows' startup list), when turned on. The uninstaller removes them.

#Deleting Octoolo's data from the PC

• Everything, with Octoolo: uninstall Octoolo (Windows Settings > Apps) and tick Delete the application data on the uninstaller's first page. That deletes %LOCALAPPDATA%\com.octoolo.app (and %APPDATA%\com.octoolo.app if it exists). See Install and update.
• Everything, keeping Octoolo installed: quit Octoolo (right-click its icon in the corner of the taskbar > Quit Octoolo, if it runs there), then in File Explorer open %LOCALAPPDATA% and delete the com.octoolo.app folder. Octoolo starts like new next time: Octoolo Cloud must be turned on again on this PC, and the parts download again when needed.
• Parts only: Settings > Downloaded parts > Remove next to an AI part or translator language (FFmpeg cannot be removed there).
• Recent tasks: Settings > Your home screen > Forget what I opened last.
• Waiting statistics: turning Send anonymous usage statistics off deletes them.

Before deleting: the Passwords vault is in that folder and cannot be recovered without it. Make an encrypted backup first (Passwords > Import & export > Save an encrypted backup, Passwords). Your own files (documents, recordings, exports) are not in that folder and are never deleted by Octoolo.

#Deleting data kept on octoolo.com

• The account (email, name, license key, PCs, sessions): delete it yourself in the profile on https://octoolo.com/account/, after cancelling a running subscription. Payment records stay with Paddle, and with Octoolo without your name or address, as long as the law requires. See License and account.
• Help and feedback messages: write to hello@octoolo.com to have them deleted.
• Usage statistics: they carry no name or email, only a random id per copy (which an account or a Help and feedback message can tie to a person, see "Usage statistics: exactly what is sent"), and are kept about 13 months. Turning them off stops new ones.
• Any other request (what is held, correcting or deleting it): write to hello@octoolo.com; the privacy policy promises an answer within 30 days.

#The website's privacy: cookies and statistics on octoolo.com

• Google Analytics only after Accept. The first visit shows a banner, "Cookies, only if you say so", with Accept and Decline. Nothing from Google loads until Accept; then Google Analytics sets _ga and _ga_ENM5P5RMYR (up to two years). Decline (or Escape) loads nothing. The choice is kept in the browser's local storage (octoolo-consent). Browsers that send Global Privacy Control are taken as a no and see no banner. Change your cookie choice on the privacy policy page asks again.
• Octoolo's own visit counter, without cookies: the page, the site that sent you, campaign tags, clicks on Download and outside links, the kind of device, browser and system, and the country. The IP address is not kept with them; Do Not Track or Global Privacy Control turns it off. Kept about 13 months.
• Account cookies: octoolo_account (needed to show the account, 30 days or until sign-out), octoolo_in (only the first letter of your name, for the menu), and octoolo_google (up to ten minutes, while signing in with Google).
• The server keeps standard logs (IP address, page, browser) for about two weeks.
• The chat (the Ask Octoolo button): what the visitor types, the assistant's earlier answers in the same conversation, the page's address and the site's language go to OpenAI, which provides the AI model, to write each answer. OpenAI does not use them to train its models and may keep them for up to 30 days to prevent abuse. Octoolo does not keep the conversation: it stays in the browser tab (octoolo.chat, session storage) until the tab closes or New chat. The IP address is used in memory only, to limit questions. With Google Analytics accepted, Analytics counts that the chat was opened and a question sent, never the text.

More about the website: octoolo.com.

#Octoolo's privacy policy

The privacy policy is at https://octoolo.com/privacy/, and in Spanish (https://octoolo.com/es/privacidad/), Portuguese (https://octoolo.com/pt/privacidade/) and German (https://octoolo.com/de/datenschutz/). It covers the app (what it sends), the subscription (Paddle is the merchant of record and collects payment details; Octoolo never sees card numbers), the account, the website, messages to hello@octoolo.com, and your rights. The terms and refund policy are on the same site (Plans and billing).