Privacy policy
There is no telemetry, no analytics and no account. This page exists to prove that specifically rather than assert it generally, by listing every outbound request the software can make and how to switch each one off.
Summary
In one paragraph
Your rules, profiles and statistics stay on your machine in a local database. The software sends nothing about your traffic anywhere. If you buy a licence we hold your email, licence key and activation records — nothing else. The website has no analytics, no cookies of its own and no third-party trackers.
Two things are worth being precise about, because "we don't collect data" is often technically false in the details:
- The software makes outbound requests you configure — speed tests, health a speed test you started. Those go to the measurement endpoint, not to us. They are listed individually below.
- Buying a licence necessarily involves the payment processor and us holding a record. That is described in licence data and checkout.
Data on your machine
Everything the application creates is local. None of it is transmitted, and there is no mechanism in the software to transmit it.
| What | Where | Can you disable it? |
|---|---|---|
| Profiles and rules, including any hostnames you typed | Local SQLite database | No — this is the configuration itself |
| Per-adapter and per-application statistics | Same database | Yes — set retention to zero |
| Speed test results | Same database | Yes — clear history, or never run one |
| Resolved addresses for domain rules | In-memory cache, plus database | Only by not using domain rules |
| Service log: routing operations and events | Rolling local log files | Level is configurable; log rotation is fixed |
| Audit log with rule attribution | Rolling local log files | Yes — off by default |
| Route snapshots | Local file, ACL-restricted | No — this is the safety mechanism |
| Licence record and activation state | Same database | No, while a paid licence is active |
No packet contents are captured or stored at any point. The software reads connection metadata — process, remote address and port, protocol, byte counts — because that is what routing decisions require. It does not terminate TLS, install a certificate, or inspect payloads.
Every outbound request the software can make
This is the complete list. If you observe the software connecting to something not on it, that is a bug and we want to hear about it.
| Request | Goes to | Contains | Disable |
|---|---|---|---|
| Licence activation | Our licence endpoint | Licence key, salted hash of machine identifiers, software version | Not needed during the trial. Enterprise can activate offline. |
| Update check | Our release endpoint | Current version only. No identifier, no key. | Settings toggle |
| Speed test | The measurement endpoint you configure | Test payload only | Do not run one |
| Health probe | The target you configure per adapter | ICMP echo, TCP connect, or an HTTPS GET | |
| The resolver you configure per adapter | Standard DNS queries | Off by default | |
| Your own URL | Event JSON you can inspect, plus your optional shared secret | Off by default | |
| Diagnostic report upload | Nowhere — it writes a file | You choose whether to send it, to whom | Not applicable |
Only the first two involve us at all, and neither carries anything about your traffic, your rules or your network. Turning off the update check leaves the software making no unsolicited outbound requests whatsoever — which you can verify with any network monitor, including this one.
Licence data we hold
If you buy a licence, we hold the following as data controller. Lawful basis: performance of a contract (UK GDPR Article 6(1)(b)), and legal obligation for the financial records.
| Field | Why |
|---|---|
| Email address | Deliver the key, handle support and refunds, notify of a security issue |
| Licence key and tier | Identify what you are entitled to |
| Purchase date and update-window expiry | Determine entitlement |
| Company name and billing country, if given | Invoicing and tax |
| Activation records: hashed machine fingerprint, timestamp, version | Enforce the machine limit |
| Transaction reference from the processor | Reconcile payments and issue refunds |
We do not hold your card details — checkout is hosted by the payment processor and card data never reaches our systems. We do not hold your name unless you provide it, your address unless tax rules require it, or any information about your network.
The machine fingerprint is a salted one-way hash. It cannot be reversed to identify your hardware, and it is used only to count activations. Data is stored in the UK or EEA. It is never sold, rented or used for marketing, and there is no mailing list to be added to.
Website and checkout
This website sets no cookies of its own, runs no analytics and embeds no third-party trackers, advertising pixels or social widgets. There is no consent banner because there is nothing to consent to.
Two details for completeness. Your theme preference is stored in
localStorage in your browser and never transmitted. Fonts are loaded from
Google Fonts, which means your IP address is visible to Google when that request is
made — self-hosting them is on the list. Static hosting produces standard server logs
containing IP address, timestamp, requested path and user agent, retained briefly for
security and abuse handling.
The contact form has no backend: submitting it opens your own email client with the fields filled in, so nothing is stored on our side unless and until you actually send the email.
Checkout is hosted by the payment processor. They act as an independent controller for payment data under their own privacy policy, and pass us only the fields listed in licence data.
Support correspondence
If you email support we hold that correspondence, including anything you attach. Diagnostic reports may contain adapter names, IP addresses, process names and resolved hostnames — which is why the summary is plain text you can edit, and why it is only you can read before sending.
Support correspondence is used to answer your question and to identify recurring problems. It is never used for marketing. Ask and we will delete a thread once it is resolved.
Retention
| Data | Retained |
|---|---|
| Licence record and activation state | While the licence is valid, then 12 months for support continuity |
| Financial records and invoices | Six years, as UK tax law requires |
| Support correspondence | 24 months, or sooner on request |
| Server logs | 30 days |
| Anything on your machine | Under your control; uninstall offers to delete it |
Your rights
Under UK GDPR and equivalent legislation you have the right to access a copy of your data, to rectify inaccuracies, to erasure where no legal obligation requires retention, to restrict or object to processing, and to data portability. There is no automated decision-making or profiling.
Email privacy@fablelabs.in. Requests are answered within 30 days and usually within a few business days — the dataset is small enough that a subject access request is a short job.
Note that erasing a licence record deactivates the licence, since the record is what establishes your entitlement. Financial records must be kept for six years regardless of an erasure request, which is a legal obligation rather than a choice.
If you are unhappy with how a request was handled you can complain to the Information
Commissioner's Office at ico.org.uk, or your local supervisory authority
if you are elsewhere in the EEA. We would rather you raised it with us first.
Changes to this policy
Material changes will be noted in the changelog and the version and date at the top of this page updated. Superseded versions are available on request. Because there is no telemetry to expand and no data-sharing arrangement to broaden, the plausible changes are narrow — self-hosting the fonts being the most likely one.