Dusk VMIn short: Dusk VM has no analytics and no tracking. The app talks to us to activate and check your licence, to look for updates, and to send a crash report only if you agree. It never sends anything from inside your virtual machines. Paddle, our reseller, handles payments. This website sets one cookie, and only when you sign in to your account.
1. Who we are
Dusk Engineering Services Ltd ("we", "us"), company number 16446454, 128 City Road, London, EC1V 2NX, United Kingdom, is the controller of the personal data described here. Contact us about privacy at support@duskvm.app.
2. What the app sends
Licence activation
When you enter a licence key, the app sends our licence server:
- the licence key;
- a SHA-256 hash of your computer's hardware identifier (on a Mac, its platform UUID). The identifier itself never leaves your computer; the hash lets us recognise the same computer again without knowing the identifier;
- the platform (Mac, Windows or Linux);
- your computer's name, as set in its sharing settings, so you can tell your computers apart on the account page;
- the app version.
Our server also sees your IP address, which is recorded in its logs. We store the activation (the hashed identifier, platform, computer name, app version, and when it was first and last seen) with your licence until you remove that computer or the licence is deleted.
Licence checks
From time to time the app asks the server to refresh its activation token. It sends the current token (which contains the details above plus the name and email address on the licence) and the app version. The server updates the "last seen" time. This is how renewals, freed seats and refunds reach the app.
Update checks
The Mac app from our website checks our update feed for new versions, automatically and when you choose Check for Updates. The request includes the app's name and version and, like any web request, your IP address. It does not include a profile of your computer. The Mac App Store version doesn't check our feed: the App Store updates it.
Crash reports, only if you agree
If the app or its Windows engine crashed, the app asks the next time it opens whether to send the report. Nothing is sent unless you choose Send, or have turned on automatic sending (off by default). A report contains the crash log that macOS wrote, with your home folder path shortened to ~, the app version, the operating system version and any note you add. Our server records the IP address it came from. Crash reports never contain anything from inside your virtual machines.
What the app never sends
The app has no analytics, advertising identifiers or usage tracking. It does not send us what you run, the contents or names of your virtual machines, your files, or anything you type.
Downloads from other publishers
Guest operating system images in the catalogue are downloaded directly from their publishers' servers (for example Ubuntu, Fedora, Debian, Kali and Alpine mirrors, and Apple for macOS restore images); Windows drivers are downloaded from the Fedora Project. Those servers see your IP address and their own privacy policies apply. Windows 11 is downloaded by you from Microsoft's website.
3. This website
- No analytics, no tracking cookies. We don't use Google Analytics or any similar service, advertising pixels or social media widgets.
- One cookie: when you sign in to your account, we set a session cookie that keeps you signed in. It is strictly necessary for the account page, holds a random token and nothing else, and is removed when you sign out or it expires.
- Server logs: like most websites, our server logs each request's IP address, time, address requested and browser type, to keep the service running and secure.
- Pricing page: the pricing page loads Paddle's checkout script from Paddle's servers. Paddle may use its own cookies or similar storage to show local prices and run the checkout, under Paddle's privacy notice.
4. Buying Dusk VM
From the Mac App Store
If you buy in the Mac App Store version, Apple sells it to you and processes your payment under Apple's privacy policy. The app checks your purchases with Apple on your Mac and doesn't send them to us. Apple gives us sales reports without your name or email address. The rest of this section is about buying from our website.
From our website
On our website, Paddle.com is our reseller and the Merchant of Record for every order, so Paddle is the seller you pay. Paddle collects and processes your payment details, billing address and tax information as a controller in its own right, under its own privacy notice. We never see your card details.
Paddle sends us the details we need to issue and manage your licence: your name and email address, your country, what you bought, and transaction and subscription details and their changes (such as renewals, cancellations and refunds). We keep these with your licence.
5. Your account and emails
We use your email address to send your licence keys, the sign-in links you ask for, and messages about your licence or subscription. We don't send marketing emails. Sign-in links are single-use and expire; we store only a hash of each link's token.
If you email us for support, we keep the conversation so we can help you and refer back to it.
6. Why we use your data (legal bases)
| Purpose | Legal basis under the UK GDPR |
|---|---|
| Issuing, activating and checking licences; sending keys and sign-in links; the account page | Performing our contract with you |
| Update checks | Performing our contract with you, and our legitimate interest in keeping the software secure and working |
| Crash reports | Your consent, which you can withdraw at any time by turning automatic sending off and choosing Don't Send |
| Server logs, preventing licence abuse and fraud | Our legitimate interest in running a secure service |
| Keeping order records | Our legal obligations, for example for accounting and tax |
| Answering support requests | Our legitimate interest in helping you, or performing our contract with you |
7. Who we share it with
We don't sell your data or share it for advertising. We share it only with:
- Paddle, which sells Dusk VM on our behalf and manages payments, subscriptions and refunds;
- our hosting provider, which runs the server for this website and the licence service ([provider to be confirmed]);
- our email delivery provider, which sends licence and sign-in emails ([provider to be confirmed]);
- professional advisers and authorities where the law requires it.
If any of these process data outside the UK, we make sure appropriate safeguards are in place, such as the UK International Data Transfer Agreement or an adequacy decision.
8. How long we keep it
| Data | Kept for |
|---|---|
| Licences and order details | For as long as the licence exists, then [period to be confirmed, for example six years for accounting records] |
| Activations (computers) | Until you remove the computer or the licence is deleted |
| Crash reports | [period to be confirmed] |
| Server logs | [period to be confirmed] |
| Sign-in links and sessions | Until they expire, or you sign out |
| Support emails | [period to be confirmed] |
9. Your rights
Under UK data protection law you have the right to ask for a copy of your personal data, to have it corrected or deleted, to restrict or object to how we use it, to receive it in a portable format, and to withdraw consent where we rely on consent. To use any of these rights, email support@duskvm.app. We'll reply within one month.
You can free a computer from your licence yourself on the account page, which deletes its activation record.
If you're unhappy with how we've handled your data, please tell us first. You also have the right to complain to the Information Commissioner's Office (ico.org.uk).
10. Security
Traffic between the app, this website and our server is encrypted. Computer identifiers are hashed before they leave your computer, and sign-in and session tokens are stored only as hashes.
11. Children
Dusk VM is not directed at children, and we don't knowingly collect data from children under 13.
12. Changes
If we change this policy, we'll update this page and the date at the top. If a change affects how the app handles your data, we'll say so in the release notes.