Privacy Policy

Parties, defined terms and contact details

The Cygtree software (the "Software") and the website at cygtree.com (the "Website") are made and sold by Cygnus Crane L.L.C. ("Cygnus Crane"), a Wyoming limited liability company, which is the controller of the personal data described in this Privacy Policy (this "Policy").

The person who visits the Website, takes a trial of the Software or licenses the Software is referred to in this Policy as the "User".

Polar Software, Inc. (the "Reseller") is the authorised reseller and merchant of record for the Software, as set out in clause 2.

Registered postal address of Cygnus Crane: 30 N Gould St Ste N, Sheridan, WY 82801, United States.

Contact address for all matters arising under this Policy: [email protected]

Summary

This summary is provided for convenience and does not qualify the clauses which follow.

• The Website stores no email address, whether in plain form, in encrypted form, or as a hash held against a lookup capable of recovering the address. The value it retains is described in clause 1.2.
• The Website sets no cookie. It carries one analytics measurement script, operated by Cloudflare, which uses no cookie, stores nothing on the User’s device and creates no visitor identifier (clause 1.5).
• The Reseller, and not Cygnus Crane, sells the Software, and holds the User's email address, billing details and payment record. Cygnus Crane is able to view that record (clause 2).
• The Software collects no telemetry (clause 3.5).
• Board content is never transmitted to Cygnus Crane. Where an AI agent is connected, board content passes from the User's computer directly to the provider the User selected, under the User's own account with that provider (clause 4).

1. The Website (cygtree.com)

1.1 Processing of the email address

The User submits an email address before a trial or a purchase. That address is processed as follows, in the order stated, and in no other way.

1.1.1 Simplification. The address is first converted to lower case. At mail providers known to treat such variants as a single mailbox — Gmail, Outlook, Yahoo, iCloud, Proton and a limited number of others — any +tag is removed; at Gmail, dots in the local part preceding the @ are additionally removed. By way of example, [email protected] is simplified to [email protected].

The simplified form is the form transmitted to the Reseller, and is therefore the address to which the licence key is sent by email. At the providers identified above, that address delivers to the same mailbox as the address as submitted.

1.1.2 Local validation. The format of the address is checked, and its domain is compared against a list of disposable-mail services which is contained in a file distributed with the Website's own code. No data is transmitted to any third party at this stage. These local checks are applied to every address submitted.

1.1.3 Deliverability validation. Where the local checks in clause 1.1.2 are not determinative, the simplified address may be transmitted to Kickbox (kickbox.com) for the sole purpose of establishing whether mail to that address would be undeliverable or whether the address is a disposable one. That transmission occurs only in respect of addresses which the local checks did not determine, and only where a daily processing budget has not been exhausted. Any result returned is retained for 30 days, indexed against the fingerprint described in clause 1.2, so that the same address is not submitted for validation twice.

1.1.4 Transmission to the Reseller. The simplified address is transmitted to the Reseller, which sells the Software to the User and issues the licence key by email. See clause 2.

1.1.5 Discard. The address is thereafter discarded. It is not written to any storage controlled by Cygnus Crane. It exists only in the memory of a single request and ceases to exist when that request terminates.

1.2 The trial fingerprint

The trial licence activates on one computer, runs for three days, provides the full functionality of the Software, and requires no payment card. That entitlement is capable of being abused, in that one person may otherwise take an unlimited number of free trials, and it is therefore necessary to be able to establish whether a given address has already taken one.

Retaining a list of email addresses in order to answer that single question would require Cygnus Crane to maintain a database of customer addresses. In order to avoid maintaining such a database, Cygnus Crane retains no addresses. The value retained in place of each address is:

SHA-256( a secret salt + the simplified address ), expressed as 64 hexadecimal characters.

That value has the following properties:

• It cannot be reversed into the address. A cryptographic hash is a one-way operation.
• It is not susceptible to guessing. An unsalted hash of an email address would not be private, because the population of real addresses is small enough that a holder of the stored values could hash candidate addresses until one matched. The secret salt prevents that attack. The salt is held as a server secret and is not contained in the code.
• It remains capable of answering the single question stated above. Where an address is supplied, it is hashed and the resulting value is tested for presence in the store. That is the only query the system performs.

Characterisation under the GDPR. The process described in this clause 1.2 constitutes pseudonymisation and not anonymisation. A specific address remains capable of being tested against the store, and the stored value is accordingly personal data under the GDPR and is treated as such throughout this Policy. The practical consequence is that, in the event of disclosure of the store in its entirety, the data disclosed would consist of hexadecimal strings and would contain no email addresses.

The same fingerprint is transmitted to the Reseller as the customer identifier. That transmission fixes the email field on the checkout page to the address actually submitted, so that the trial limitation cannot be circumvented by altering the address on the Reseller's page following submission.

1.3 IP addresses

The User's IP address is subject to two processing operations.

1.3.1 Rate limiting. In order to prevent repeated automated submissions from a single machine, requests are counted per IP address per hour. The counter is stored under a key which incorporates the IP address, with the consequence that, for a period of approximately 70 minutes, the store holds a record that the IP address in question made a request. That record expires automatically and is then deleted.

1.3.2 Cloudflare. The Website is hosted on Cloudflare Pages and the code which handles the submission form executes on Cloudflare's network. Cloudflare necessarily receives the IP address of every visitor as an incident of delivering the Website, and applies its own security processing at the network edge. That processing is Cloudflare's processing and is governed by Cloudflare's terms. Cloudflare's edge may additionally set a cookie of its own on this domain as part of that security processing. Any such cookie is Cloudflare's and is not set or controlled by the code of the Website.

1.4 Non-transmission of the IP address to the Reseller

The Reseller is capable of using a buyer's IP address to pre-populate the billing country and select a currency. The checkout code of the Website does not forward that address, with the result that the Reseller presently receives a Cloudflare server address rather than the User's.

1.5 Cookies, analytics and tracking

• No cookie is set by the Website. The Website's code contains no cookie handling of any kind, and the measurement script described below sets none. Cloudflare's edge is a separate matter and is addressed in clause 1.3.2.
• Nothing is stored on, or read from, the User's device. The Website makes no use of local storage, session storage or any other client-side store.
• One analytics measurement script is present. Every page of the Website loads beacon.min.js from static.cloudflareinsights.com. This is Cloudflare Web Analytics. It is injected by Cloudflare at the edge rather than written into the Website's source, and it is present on every page of the Website without exception, including this Policy.
• No advertising script is present, no data is shared with advertisers, Cygnus Crane having no advertisers, and no data is sold or shared for advertising purposes by any party.

1.5.1 What the measurement script collects

Cloudflare states that the measurement described in this clause collects the address of the page requested, the referring address, the browser user-agent string in aggregate form, page performance timings (the metrics commonly known as Core Web Vitals), the HTTP response status, and a country derived from the User's IP address. Cloudflare states that the IP address is used for that derivation and is not stored, and that query strings are not recorded.

No visitor identifier is created and no device fingerprint is taken. There is accordingly no concept of a returning or unique visitor in the measurement, and Cygnus Crane cannot single out, follow or recognise any individual person across pages or across visits by means of it. What Cygnus Crane obtains is aggregate counts.

1.5.2 Legal basis, and why no consent banner is presented

No cookie consent banner is presented. Article 5(3) of Directive 2002/58/EC (the ePrivacy Directive) requires consent for the storing of information, or the gaining of access to information already stored, in a User's terminal equipment. The measurement described in this clause 1.5 does neither: it sets no cookie and writes nothing to the User's device, and there is therefore no storage or access to which consent could be given.

The processing nonetheless involves an IP address, however transiently, and is undertaken on the basis of the legitimate interests of Cygnus Crane in understanding the volume of traffic to the Website and the performance of its pages, pursuant to Article 6(1)(f) of the General Data Protection Regulation. That interest is pursued by means that create no identifier and retain no address, which is the minimum capable of serving it.

The further qualification to this clause 1.5 is Cloudflare's edge processing, which is not operated by Cygnus Crane and is described in clause 1.3.2.

1.6 Third-party requests: Google Fonts

Every page of the Website other than the post-checkout page at cygtree.com/thanks loads two typefaces from Google Fonts (fonts.googleapis.com and fonts.gstatic.com). The User's browser requests those files directly from Google, with the consequence that Google receives the User's IP address and browser details on opening the page. No cookie is set by that request, and the referrer policy applied by the Website causes Google to be informed only that the request originated at cygtree.com, and not of the particular page.

1.7 The post-checkout page

Following payment, the Reseller returns the User to cygtree.com/thanks with a single-use checkout identifier in the URL. That page uses the identifier to request the licence key from the Reseller in order to display it to the User immediately, rather than requiring the User to await the email.

Nothing on that page is stored by Cygnus Crane. The page is marked no-index and is accordingly excluded from search engine indexes.

2. Purchase: the Reseller as merchant of record

Polar Software, Inc. (3500 South DuPont Highway, Dover, DE 19901, USA) is the seller of record for the Software. The User purchases from the Reseller, and the Reseller licenses the Software to the User on the terms of Cygnus Crane. The Reseller administers payment and tax, issues the receipt, and generates and transmits the licence key.

The Reseller accordingly holds the User's email address, billing name and address, tax details where applicable, and the record of the order. Payment card details are processed by Stripe, the Reseller's payment processor; they do not reach the Reseller in full and do not reach Cygnus Crane at all.

Access available to Cygnus Crane. Every person who purchases the Software or takes a trial appears as a customer in the Reseller's dashboard, together with that person's email address, billing details and order history. Cygnus Crane holds access to that dashboard. Accordingly, although the systems operated by Cygnus Crane store no addresses, Cygnus Crane is able to look up a User's address in the Reseller's systems.

The Reseller's own handling of the User's data is governed by the Reseller's terms and not by this Policy. The Reseller's current terms are as follows:

• Polar Privacy Policy — polar.sh/legal/privacy-policy
• Polar Buyer Terms — polar.sh/legal/checkout-buyer-terms
• Polar sub-processors — polar.sh/legal/sub-processors

The trial record. On completion of a trial order, the Reseller notifies the Cygnus Crane server, and a single record is written comprising the fingerprint described in clause 1.2, the time, and the Reseller's order identifier. No other data is written, and no address is written. That record is the means by which a second free trial is refused.

Purchases are not recorded by Cygnus Crane. Purchase of the Software does not add the User to any list or record held by Cygnus Crane.

3. The Software on the User's computer

The Software is a Windows desktop program. Boards are files held on the User's own disk. There is no account, no sign-in and no cloud synchronisation.

3.1 Licence activation and validation

On activation of a licence, the Software transmits to the Reseller's licence API (api.polar.sh):

• the licence key;
• the Cygnus Crane organisation identifier;
• a label, consisting of the Windows name of the User's computer together with the first eight characters of the machine fingerprint described below — for example OFFICE-PC (a1b2c3d4); and
• the machine fingerprint.

The label is the single item of directly personal information transmitted by the Software. Its purpose is to enable the User to distinguish between the User's machines in the Reseller's customer portal when releasing an activation slot. Where a computer is named after its owner, that name is what the Reseller receives.

The machine fingerprint is not a hardware serial number. It is SHA-256(a fixed prefix + the Windows MachineGuid), truncated to 32 hexadecimal characters. The raw MachineGuid is neither stored nor transmitted; it is hashed first, so that the licence file held in the User's own folder cannot be used as a cross-product identifier for the machine. Where the Software is unable to read the MachineGuid, it continues to operate rather than denying access.

The transmission described in this clause 3.1 occurs:

• on selection of Activate;
• on selection of Deactivate; and
• once, automatically, on each start of the Software, in order to re-verify that the licence remains valid. Deactivation and validation transmit the licence key, the organisation identifier and the activation identifier; they do not transmit the computer name.

No timer, background polling or further check is operated. The User is nonetheless put on notice that the once-per-launch check constitutes a request to a third party, made each time the Software is opened, recording that the licence is in use.

3.2 Downloads initiated by the User

Each of the above is an ordinary download. No board content, identifier or account information is attached to it. The link downloader identifies itself by a user-agent string of Cygtree/0.1.0 (board media downloader) and by no other means; it refuses any resource which is not an image, video, PDF or audio file, and refuses to reach addresses on the User's own network or local machine.

3.3 Video cards: transmission to YouTube and Vimeo

Where a card on a board holds a YouTube or Vimeo link, the Software renders that video's own player on the canvas and displays a thumbnail image obtained from Google. Accordingly, the User's IP address and ordinary player traffic are transmitted to Google or Vimeo for so long as such a card is on screen, in the same manner as if the video had been opened in a browser. YouTube embeds use the youtube-nocookie.com domain, which limits, but does not eliminate, the data Google receives.

No other board content reaches any third party.

3.4 Microsoft Edge WebView2

The Software renders its interface using Microsoft Edge WebView2, a Microsoft component forming part of Windows. The Software alters none of that component's diagnostic settings, with the result that WebView2 operates at Microsoft's defaults as those defaults stand on the User's machine. The statement that the Software collects no telemetry is therefore a statement as to the Software's own code, and is not a statement that no data leaves the User's computer.

Where the WebView2 runtime is not already present on the machine, the installer downloads it from Microsoft at the time of installation.

3.5 Telemetry, crash reporting and usage data

The Software operates no telemetry, no crash reporting and no usage analytics. Cygnus Crane represents that the statements in this clause 3.5 correspond to the source code of the Software as released.

• No analytics library of any kind is present in the Software.
• No count is kept of boards, cards, sessions, features used or time spent.
• The Software writes a diagnostic log, shell.log, to the User's disk only. The Software contains no code which reads that log and transmits it. Disclosure of the log to Cygnus Crane requires the User to send it.
• Where the interface encounters an error, that error is written to the same local log. It is not uploaded. No crash reporting service is used.
• The log is constructed to hold step names, error types and file paths chosen by the User, and neither tokens nor the contents of boards. Secrets are stripped from any output produced by an AI tool before that output reaches the log.

3.6 Data stored on the User's computer

The following data is held on the User's disk, and none of it is transmitted anywhere.

Two settings are enabled by default and remain enabled unless disabled by the User:

• Chat records are retained by default. The User's conversations with an AI agent are written to a permanent file adjacent to the board. That setting may be disabled in the Software.
• Board memory is enabled by default. The assistant is instructed to write notes concerning the User and the User's project into the board document itself, so as to retain them between sessions. That setting may be disabled in the Software.

Neither file is transmitted anywhere. Both are held on the User's disk, and their contents accompany any board file or export which the User shares.

3.7 Images and embedded metadata

Photographs carry embedded metadata, which may include GPS coordinates, camera serial numbers and timestamps. The treatment of that metadata by the Software depends upon the manner in which the image was added to the board, as follows.

• Images downloaded by the Software from a web link — whether because the User pasted a link or because an AI agent added one — have their metadata stripped before storage. EXIF, XMP and IPTC blocks are removed from JPEG, PNG and WebP files.
• Images added by the User from the User's own disk — whether by the file picker or by drag and drop — are stored exactly as supplied, metadata included. Nothing is removed.

Accordingly, a photograph added by the User from a camera roll retains its GPS coordinates within the board's media folder, and within any board file or export shared by the User with a third party. The Software does not read that metadata, does not transmit it and performs no operation upon it; it does not alter the User's file.

A User who requires that location data not be retained should remove that metadata from the file before adding it to a board.

4. Boards and connected AI agents

Cygnus Crane holds no AI provider key and operates no AI service. There is no Cygnus Crane API. Cygnus Crane has no means of access to the User's prompts or boards, which are never transmitted to it.

Where the User connects an AI agent, the arrangement is as follows.

1. The Software starts the AI tool already installed by the User — Claude Code, Codex, Cursor, or any agent implementing the Agent Client Protocol — as an ordinary program on the User's own computer.
2. The User's prompt, together with any card images attached to it, is passed to that program.
3. That program then communicates with its own provider, on its own account and using its own credentials. The Software neither observes that traffic nor holds those credentials.
4. The tools by which the agent reads and modifies the board are served to it on the User's own machine, on a port selected at random on each run. The sole exception is a board address configured by the User for an agent connection: the Software passes the agent the address the User has set and does not verify that it is a local address, with the consequence that a remote address would direct that traffic to the remote location.

Board content therefore passes from the User's computer directly to the AI provider selected by the User, under the subscription or API account the User holds with that provider.

The following qualifications apply.

• The AI provider is a third party and its terms govern its treatment of the User's prompts, including whether it logs, retains or trains upon them. That relationship subsists between the User and that provider. Cygnus Crane makes no representation as to that provider's practices, having neither control over them nor the means to verify them.
• The local connection is not a security sandbox and is not represented as one. Any process running on the User's computer with the User's privileges is, in principle, capable of reaching that port. It is a boundary of convenience and not a security boundary.
• An AI agent has file and shell tools of its own. The Software instructs an agent not to request that the Software read files. That instruction says nothing as to the agent's own ability to read the User's disk directly, which is a capability of the agent and is not sandboxed by the Software.

5. Data held by Cygnus Crane: categories, location and retention

The following table is an exhaustive statement of the data held directly by Cygnus Crane.

The User's email address does not appear in the table above, because it is not stored. Nor is the User's name, postal address, payment card, country, or any data concerning use of the Software.

The User's order and email address are held by the Reseller, under the Reseller's retention terms. See clause 2.

6. Categories of data not collected

• No name, postal address or telephone number is collected by the Website or by the Software, subject to the single exception stated in full at clause 3.1: on activation, the Software transmits the Windows name of the User's computer to the Reseller as a label, and where the User has named that computer after the User, that label constitutes a name. The Reseller separately collects billing details for the sale, as set out in clause 2.
• No payment or card information reaches Cygnus Crane.
• No account data, there being no account.
• No session recording and no heatmaps, by the Website or by the Software. The Software collects no usage data or feature analytics of any kind (clause 3.5). Aggregate page-level measurement of the Website is the single exception, is disclosed in full at clause 1.5, and identifies no person.
• No contents of boards, cards, notes, files, images or AI conversations.
• No contact list, address book or browsing history.
• No advertising identifiers. No data is sold or shared with any person for advertising purposes.
• No location data. The Software does not request it, and the permissions policy of the Website disables geolocation, camera and microphone for the page.

7. Rights of the data subject

Depending upon the User's place of residence, the User may hold rights to access, rectify, erase or export personal data concerning the User, to object to processing, and to lodge a complaint with a supervisory authority.

The following sets out what Cygnus Crane is in fact able to do in respect of the data it holds.

• Erasure of a trial record. Where the User supplies the address used, Cygnus Crane is able to compute its fingerprint, locate the corresponding record and delete it. The consequence of that deletion is that the free trial becomes available to that address again.
• Confirmation whether a trial record exists for a given address. By the same mechanism.
• Cygnus Crane is unable to list its records by name or by address, those records being indexed by neither and containing no addresses capable of being searched. That is the position described by Article 11 of the GDPR: the controller holds data which does not permit identification of the data subject without the data subject supplying the identifier. A request can accordingly be answered only where the User supplies the address concerned.

Matters concerning an order — receipts, refunds, the email address, billing details and deletion of the customer record — are held by the Reseller. A User may nonetheless direct such a request to Cygnus Crane, which shall state what it is able to see and what must be directed to the Reseller.

Requests are to be made by email to [email protected].

Cygnus Crane shall use reasonable endeavours to respond within two business weeks, being ten working days. That period is an endeavour only, and no guarantee as to it is given.

Where applicable law imposes a shorter period than that stated above — such as the one-month period prescribed by the GDPR for a data-subject request — the statutory period shall prevail.

8. Location of processing

Cygnus Crane is established in the United States. Cloudflare operates the Website on a global network, with the consequence that the code which processes the User's email address executes at whichever Cloudflare location is nearest to the User, and the store to which it writes is a Cloudflare service held on Cloudflare's own infrastructure. The Reseller and Stripe are United States companies.

9. Children

The Software is a tool for adults and is not directed at children. Cygnus Crane does not knowingly collect data from children.

10. Amendment of this Policy

Where this Policy is amended, the date stated at the head of it is amended with it.

This Policy is written on the principle that every factual statement in it is to be true of the Software and the Website as they are in fact operated. Where a change to either renders a statement in this Policy inaccurate, the statement is corrected in the same release as that change, and is not corrected by rendering it vague.

11. Contact

Cygnus Crane L.L.C.
30 N Gould St Ste N, Sheridan, WY 82801, United States
[email protected]

For matters concerning orders, payment and refunds, the seller of record is Polar Software, Inc., 3500 South DuPont Highway, Dover, DE 19901, USA.

The remaining documents are the licence and the terms of sale.