Security and privacy at BlueThroat Studio

The principle: your data stays with you

Most security problems in business software start with a copy of your data on someone else's server. We avoid that by design. The apps do their work on your machines, so there is no central database of your customers, your timesheets or your screenshots for anyone to breach, subpoena or sell.

What we do receive is limited to what is needed to sell and support the software: your name and email for a licence, a licence record, and any message you send to support.

Casement

• Casement asks for the Accessibility permission, which macOS requires to see, move and focus other apps' windows. It does not need Screen Recording and does not capture window contents.
• Settings are stored on your Mac. Nothing about your windows, tabs or profiles is sent to us.
• The app is signed and notarised by Apple, so macOS can verify who built it and that it has not been altered.
• Activation of the paid feature checks a licence with our server; the licence itself is then verified on your Mac.

See the Chrome profile Dock icons and guides for how permissions are used.

Dealer Garage

• Inventory, customers, leads, deals, forms and documents are stored in a database on the dealership's computer and are included in backups you control.
• Everything works offline. Only online services, such as a VIN lookup against the US government's NHTSA database, licence activation, Marketplace posting and email, use the internet.
• Pro lets other computers in the office connect to the main one. Each user has a login and a role, and the server enforces what each role can do.
• We do not host your data. If you lose a computer, restore from your own backup.

For dealers handling credit applications and personal data, read credit applications and customer privacy and PIPEDA and dealer customer data.

Clockgauge

• Before anything is recorded, the employee sees a consent screen that lists what is captured and what is never captured.
• Data travels between the employee app and the Host over an encrypted channel with forward secrecy, pinned to the Host's identity key so that impersonation fails.
• Screenshots and secrets are encrypted on disk on the Host. Screenshots are deleted after the retention period you set, 30 days by default.
• Remote access uses a small matchmaking service to introduce the two computers and then steps aside; the screenshots and time data go straight between them.
• The Host has named accounts with roles (Owner, Manager, Payroll, Viewer), password rules and lockout after repeated wrong attempts.

More detail is on the security and encryption page, and legal context is in is employee monitoring legal.

This website

We count page views and downloads to learn which pages help. The count does not store IP addresses and does not use advertising trackers. We do not sell or share visitor data. See the privacy policy for details.

Reporting a problem

If you believe you have found a security issue in one of our apps or on this site, email support@bluethroatstudio.com with the word "security" in the subject and enough detail to reproduce it. Please give us reasonable time to fix it before sharing details publicly. We will acknowledge your message and tell you what we find.

This page describes how our apps are designed. It is not legal advice, and your own obligations depend on where you operate.