the software store and the aps apps

this section covers store.anchorpoint.studio and the aps apps you install from it. the rest of the policy still applies.

your account

you sign in with your email address and a 6-digit code we email you. there is no password. a new address creates an account. we hold: your email address, the date you signed in, your orders, your license keys, and the machines activated on them (next section). your store account is separate: it is not shared with portal.anchorpoint.studio or any other site of ours.

payments

payments are taken by square. your card details go straight from the payment form to square; we never see or store a card number. square gives us a customer id, a payment id, the last four digits and card brand for your receipts, and the result of each payment. square keeps its own records under its own privacy policy (squareup.com/legal). for subscriptions, square stores your card and charges it each period; cancelling on your account page stops that at the end of the paid period. we also hold your billing country, because we need it for tax.

license checks: exactly what an app sends

the apps check their license with our server. this is the complete list of what a check carries.

when you activate:

• your license key;
• the app's name and version, and your windows version;
• a hashed machine id: a one-way hash of the id windows created when it was installed (the registry value "MachineGuid"). we never receive the id itself, and the hash cannot be turned back into it or into anything else about your pc;
• the machine label: your windows computer name (up to 64 characters), so you can tell your machines apart on the account page. you can rename the label there;
• the ip address the request came from, which every web server sees.

on every later check (about once a day while an app runs and is online, and when you press "check now"):

• the signed license token the server gave you, the hashed machine id and the app version.

on an update check:

• the license token and the app version. the server answers with a list of builds; the download itself goes through our content server with a short-lived signed link.

when you sign a pc out from inside an app:

• the license token (or your key, if the app has no token) and the hashed machine id.

what a check never carries: your files, footage, file names, folders, project contents, what you worked on, how long you used the app, or which features you used. the apps contain no analytics, no usage statistics and no tracking. nothing leaves your pc except a license check, an update check and a feedback report you choose to send.

what we keep from the checks: for each key, the machines on it (the hashed id, the label, the products activated, first seen, last seen, active or signed out) and the time of the last check. server logs keep the ip address and the request line for as long as we need them to run and protect the store. we use the logs to stop abuse (rate limits, key sharing) and to debug.

why we do this: to count the machines a key is used on (3 or 10 at a time) and to turn a key off after a refund. that is the contract you bought.

the aps hub (later)

if we release the aps hub, it talks only to the store and our content server, on the same terms as the apps, and adds no telemetry.

feedback and crash reports

every app has a "send feedback" control and, after a crash, offers to send a report. sending is always your choice. a report contains:

• what you typed, the type (bug, idea, problem, question), and whether you want a reply;
• the app name, version and build, your hashed machine id, your windows version, build, architecture and locale, and (in aps player, aps encode and dms depth) your gpu name and driver version;
• a summary of the app's settings with passwords and paths to secrets removed (up to 8 kb);
• your email address, only if you are not signed in with a key or if you ask for a reply;
• only the attachments you tick: the last 200 lines of the app's log (which can contain file and folder names from your pc), a crash dump or crash text (a dump contains the memory of the stack at the time of the crash and can include fragments of what the app was working on), or a screenshot (off by default, never offered inside after effects). the panel's "what's included" shows each one before you send.

the report never contains your license key. our server derives your plan and the last four characters of the key from the token.

what happens to a report: it goes to our inbox, we get an email. the report and its attachments stay on our server. if a report arrives from an app without a valid key, we hold it until we approve it. crash reports are grouped by their stack signature so a repeated crash joins the existing report.

if the report cannot be sent (you are offline), the app stores it on your pc and sends it the next time it is online, for up to 30 days; you can delete it from the outbox before then.

how long we keep reports: the text and details for as long as your account exists, attachments for 12 months. both are deleted when you ask or when you delete your account. you can see your reports and their status on your account page.

updates

update checks are described above. installers are downloaded from our own server, through cloudflare, with a link that expires in 10 minutes. the server logs the request like any web server. we do not record which version you run beyond what the daily license check carries.

cookies and similar

the store sets a session cookie when you sign in and a csrf token for forms. these are necessary and need no consent. cloudflare, which sits in front of the store, sets its own necessary cookies for security (__cf_bm, cf_clearance and _cfuvid).

the meta pixel: the store's pages load a meta (facebook) pixel so we can measure ads. outside the united states the pixel loads only if you accept it in the consent banner (we read your country from cloudflare's country header); inside the united states it loads without a banner. you can withdraw consent in the footer at any time. meta's own policy covers what it does with the signal.

who else sees your data (processors)

• square (payments, subscriptions, refunds; united states).
• cloudflare (hosting edge, downloads, country lookup, email obfuscation, fonts; united states, with edge servers worldwide).
• resend (sign-in codes, keys, receipts, support and feedback replies; united states).
• our own server, which runs the store and its database, behind cloudflare.

we sell nothing and share nothing beyond this. we and our providers (cloudflare and square) store and process your data in the united states; where the law asks for it, we rely on our providers' standard contractual clauses for data from the eu and uk.

how long we keep things

your choices and rights

on your account page you can:

• see every key, every machine (label, first and last seen, products) and sign a machine out;
• rename a machine label, or change your email (we verify both addresses and update the square customer);
• export everything we hold about you as a json file;
• delete your account. we anonymise your orders (kept for tax), delete your email, keys, machines and reports, and revoke your keys (the apps on your machines stop working at their next check; the page warns you first);
• ask for a refund within 14 days;
• see your feedback reports and their status.

if you are in the eu, the uk or another place with data-protection rights, you also have the rights to access, correct, erase, restrict, port and object, and to complain to your supervisory authority. email [email protected] and we answer within 30 days. we do not profile you and make no automated decisions about you, apart from the rate limits that stop abuse.

children

the store and the apps are for people old enough to make a contract where they live.

changes

we date this policy. a change that affects what the apps send comes with an app update and is listed in its release notes.