Privacy

The stance, stated plainly

• Your revenue data never leaves your machine

  Charges, refunds, subscriptions, customers and payouts are written to an encrypted database in your application data folder and read from there. There is no AllRev account, no sync service and no backup of your numbers anywhere but on your own disk.

• Your provider keys are never sent to us

  A key you paste is sealed into this device's keychain and used only for read requests to the provider it belongs to. It is never written to a file in plain text and never sent to any AllRev host — neither of our two requests has a field it could travel in. AllRev does not log credentials, and the support log export redacts anything key-shaped it finds.

• There is no telemetry, no analytics and no crash reporting

  Not disabled by default — absent. The table below is the complete set of hosts compiled into the binary, and no analytics or crash-reporting host is on it. Every outbound request is checked against that list before a socket is opened, and one aimed anywhere else is refused rather than sent — including a redirect that tries to leave the list mid-request.

• There is no exchange-rate service either

  That is why totals are grouped by currency rather than converted into one: converting would mean asking a third party for rates, and telling it when you are looking at your revenue.

Where your data lives on your machine

• The ledger

  One SQLCipher database in your application data folder, encrypted with AES-256. Everything AllRev has synced is in it — including the record of when each host below was last contacted.

• The key that unlocks it

  Held by the operating system — Keychain on macOS, Credential Manager on Windows — not by a file next to the database. Your provider keys are sealed under that same key.

• The diagnostic log

  A plain text file beside the ledger, and the only unencrypted file AllRev writes — which is why the export described below redacts it before it goes anywhere you might send it from.

Every host the app can contact

Twelve hosts, no more: ten belong to payment providers — the seven v1 providers, three of which (Paddle, Polar, Dodo) keep a separate sandbox or test host — and two are AllRev's own licence and update services. The list is enforced in code, crates/revcore/src/http/allowlist.rs, and adding a host there is a code-review event, not a setting.

A provider host is only reached for an account you connected yourself; being on the list is permission, not a promise to call.

As with any HTTPS traffic, whoever runs your network can see which of these hosts you connected to and when. They cannot see what was read.

The two AllRev hosts, in detail

• license.allrev.app — the licence check

  It activates this device, renews the licence token every couple of weeks, and lists the devices your key is used on. On activation it is told: your licence key once; two salted SHA-256 device fingerprint hashes — one of your machine and boot-volume ids together, one of the machine id alone, so replacing a disk is not mistaken for buying a computer — never the ids themselves; your platform, architecture, app version, and a device name so you can recognise the machine in the device list. Later renewals send the signed token from activation — which carries a hash of your key, not the key — plus your app version.

  It is never told: any revenue figure, customer, order or currency; which payment providers you use, or that you connected any; your provider API keys; or anything about what you do in the app.

• updates.allrev.app — the update notice

  Asked whether a newer AllRev exists for your platform, and it is where the update bundle comes from when you install one — the manifest it returns is not allowed to point anywhere else. It is told: your platform, architecture, current version, update channel, the same device fingerprint hash (which is what lets a release roll out to a fraction of devices at a time), and the date your update entitlement runs to. This request carries no licence key, but the hash it carries is not an anonymous one.

  It is never told: any revenue figure, customer or order; your licence key; or which payment providers you use.

The provider hosts are told your provider API key — it is that provider's own key and this is the host it belongs to, so there is no way to read your data there without sending it. Requests also carry a User-Agent: AllRev/<version> header, so a provider can tell which tool is reading the account. AllRev has no code that writes to a payment provider: every request is a GET.

Read the log yourself

AllRev has no crash reporting, so if something goes wrong the only way we ever see anything is a file you choose to send. The app exports a zip you pick the location for: the diagnostic log, redacted, plus a note explaining the file, your app version, your settings, and the record of when each host above was last contacted. Nothing is uploaded — the app writes the file and stops.

Redaction removes licence keys and tokens, provider API keys and bearer tokens, the contents of every URL query string, email addresses, money amounts, and your account name in file paths. Timestamps, host names, HTTP status codes, error codes, record counts, your app version and settings all stay — an export nobody can debug from is not worth sending. The archive opens with a note saying the same thing, so you can read it before you send it.