Pay once. Prove it to yourself, not to us.

Verified locally, not by our say-so

Your license key is an ed25519-signed token. The app verifies the signature against a public key baked into the binary, over the key’s canonical contents — no server round-trip, and no way for a revoked network to turn into a revoked tool.

Activation binds the key to the machine’s hardware id. That binding survives an OS reinstall on macOS and Windows (not Linux); a hardware swap goes through an email reset, so a key can’t be self-served onto a second machine.

A daily check that can only fail open

Once a day the app confirms the license online. If that call fails — you’re offline, we’re down, a firewall says no — the only consequence is a shorter retry interval. You are never locked out by a failed check; the only thing that clears a license is an explicit revocation, which is what a chargeback does.

Updates you can audit

Self-updates are ed25519-signed end to end: the raw manifest is verified, then the downloaded artifact, before anything is trusted. The swap is atomic, the new binary shakes hands on a health check, and a failed health check rolls back to the previous one. Release builds refuse the development signing key, so a dev build can never pass as a release.

What leaves your machine

Activation, the daily license check, update checks — and, when you connect a remote host, the signed daemon download that host needs. That is the entire list.

Your code, prompts, agent output, database contents and credentials are never proxied through us and never stored by us. There is nothing to leak because nothing is sent.