Privacy Policy

1.Who we are and what this covers

Routecore LLC ("we", "us" or "our") makes WireLens, an HTTP and HTTPS debugging proxy for Mac, iPhone, iPad and Android. This policy explains what personal data we collect when you use the WireLens apps, the wirelens.app website, License Manager at pay.wirelens.app, WireLens accounts and Team Workspace at workspace.wirelens.app, and our support. It also explains why we collect it, who processes it, how long we keep it, and what you can do about it.

We decide how this data is used, which makes us its controller. There are two exceptions. In Team Workspace, we process the content members share, and the member records, on behalf of the organization that runs the workspace. And we never receive the traffic you capture: any personal data in it is yours to look after.

Apple, Google, Link (a Stripe company) and your organization's identity provider also process data about you under their own privacy policies when you use their services with WireLens.

2.The traffic you capture

The requests, responses, URLs, headers, cookies, bodies, timings and WebSocket messages you capture are stored on the device that captured them:

• On a Mac, in your user folder (in Application Support and Caches), which Time Machine and your other backups of the Mac include.
• On iPhone and iPad, in WireLens's storage on the device, which iCloud and computer backups of the device include.
• On Android, in WireLens's private storage, which Android's cloud backup and phone-to-phone transfer leave out.

The root certificate WireLens uses to decrypt HTTPS is created on your device, and WireLens never sends its private key anywhere. On a Mac only your user account can read the key, and your Mac's backups include it. On iPhone and iPad it is left out of backups, and on Android it stays in WireLens's private storage. The certificate's name includes the date and the name of your Mac or the model of your phone, which anyone you send the certificate to can see.

Each app also keeps a debug log on the device, with the host names and paths of the connections it handles. On a Mac, iPhone and iPad it is kept to about 2 MB, and clearing captures or a Factory Reset leaves it in place. On Android it is held in memory only.

Captured traffic leaves your device only when you send it somewhere yourself:

• when you export, copy or share a capture, a request or a body (exports are not redacted unless you pick a redacted format);
• when you share it to Team Workspace, as described below;
• when you share flows from the Mac app as a GitHub gist, under your own GitHub account;
• when you link an iPhone or iPad to WireLens on your Mac, or let other devices use your Mac as a proxy: their traffic then crosses your local network and is recorded on the Mac;
• when you connect an AI client or another tool to WireLens on your Mac through the MCP server or the command line tool, which can then read what WireLens captured (secrets are redacted unless you or the tool ask for them);
• when you attach a debug log to a bug report.

What happens to it then depends on where you sent it.

3.Information we collect

You can use the free plan without an account and without giving us any personal data. What we collect depends on what you do.

When you buy on wirelens.app

When you activate and use a license

• Macs. For each Mac a key is active on: the Mac's name, a one-way hash of its hardware identifier that lets us count devices, the public part of a key created in the Mac's secure hardware, which signs each request, and any note you add. For a Mac on a Team Cloud seat, also its model, macOS and WireLens versions, how it signed in, and the country it last checked in from.
• Phones and tablets. A random identifier the app creates, which stays on the device if you reinstall the app; the model, system and app versions; a name (on iPhone and iPad simply “iPhone” or “iPad”, on Android the model); any note you add; and, where the device supports it, the public part of a key in its secure hardware with the result of Apple App Attest or Android Key Attestation, which confirms the app is a genuine copy of WireLens. On Android, that result says whether the phone's bootloader is unlocked. We also keep a keyed hash of the network the device last checked in from and that network's country, and show the country to the key's owner and, for Team Cloud keys, to workspace Admins.
• History and assignments. A record of activations, moves, releases and key replacements. If you buy keys for other people, the name or label and email address of each person you assign a key to. We email them their key, and show you the devices their key is active on.
• License checks. A device with a key checks it with our license service: the Mac app when it starts, when the Mac wakes and about every hour; the iPhone, iPad and Android apps when you open them and about every 15 minutes while they stay open, never in the background. Each check sends the key, the device identifier and details above, and a signature from the device's key. We keep a keyed hash of the IP address each check comes from for 30 days. Without a key, the apps make no license checks.

When you buy in the App Store or Google Play

Apple or Google handles the payment. To see what you have bought, the iPhone, iPad and Android apps contact RevenueCat when they start and when you return to them, including on the free plan. RevenueCat receives an anonymous app user ID, your purchases, the device model (and brand, on Android), the system version, the app's identifier and version, your preferred languages and store country, your IP address and, on iPhone and iPad, Apple's identifier for vendors and the status of Apple's tracking permission, which WireLens never asks for. It does not receive your name, your email address or your traffic.

On Android, after you buy, RevenueCat saves its anonymous ID in Google Play services' Block Store, which your Google backup includes. This lets Restore Purchases find your purchase on a new phone. Google Play's billing library also sends Google its own diagnostic logs about billing, with device details such as the model, Android build, language, country, mobile network and time zone, under Google's privacy policy.

When you use a WireLens account

Your email address and name; your sign-in methods (the public part of each passkey and the name of the app that stores it, an encrypted authenticator secret, and recovery codes kept only as hashes); your sessions (the device or browser, the app or browser name it reports, and how you signed in); and the security emails we send you. When you sign in from a Mac, the sign-in link carries the Mac's name, which then labels the session.

When you ask for a sign-in code, we record the email address you entered, the country and city the request came from, and your browser or app. We show them on the approval screen and in security alerts, and delete the record after a day.

When you use Team Workspace

• Membership. The workspaces you belong to, your role, invitations (the invitee's email address and who invited them) and requests to join.
• Single sign-on and SCIM. If your organization uses them, we receive your name, email address and the identifier your identity provider uses for you, and, to set your role, your group memberships.
• Shared items. What you share, with its name, notes and summary, a label naming the WireLens version and device it came from, your name and email address as the person who shared it, and how often it has been opened.
• Activity. A record of sign-ins, invitations, role changes and changes to shared items, which Admins can see.
• Macs on Team Cloud seats. The Mac details listed above, and an hourly check-in that records a keyed hash of the network and its country.

When you contact support

The support form sends your message, your email address, your name if you give it, files you attach, the platform and app version you pick, and your browser and language. On the form, text files have credentials removed, and other files are stored as you upload them.

Report a Bug in the Mac app sends what you write, an email address if you give one, the WireLens version and build, the macOS version, the type of chip and your language and region setting, and, if you choose, a copy of the debug log that you can preview first. That copy is anonymized on your Mac: the anonymizer is designed to replace host names, IP addresses, URLs, email addresses, identifiers, app identifiers and your user and computer names with placeholders, and to remove credentials and keys. On iPhone, iPad and Android, you reach support through our website or by email, and a debug log or diagnostics report you copy or share yourself is not anonymized.

Email you send to our addresses is routed by Cloudflare to the email service that holds our mailbox. To stop abuse of our forms, we keep a keyed hash of your IP address for 30 days.

When you visit our websites

Our servers keep technical logs of requests and errors for up to 7 days.

Emails

We send emails about your purchases, licenses, account, workspace and support requests: receipts, keys, sign-in codes, security alerts, invitations and replies. We do not send marketing email.

From Apple and Google

If you allowed your device to share analytics with app developers, Apple or Google may give us crash reports and usage statistics for WireLens. They do not identify you to us.

Where we get it

Most of this comes from you or your devices. We also receive it from your organization (invitations, single sign-on and SCIM), from the person who bought a key and assigned it to you, from Link about purchases on our website, from Apple, Google and RevenueCat about store purchases, and from Cloudflare, which tells us the country and city an IP address belongs to.

4.Permissions the apps ask for

To show which app or device made each request, the Mac app also reads the name, identifiers and launch details of the apps that open connections, and looks up the names of devices on your local network through Bonjour, your router and your DNS server. These details are saved in your captures and leave your device only in captures you export or share.

5.Connections the apps make on their own

Apart from these, the apps connect only where you tell them to: the servers your captured apps contact, requests you send with Compose, replays and scripts, an upstream proxy you set, and GitHub when you use gists.

6.How we use it

We use personal data only for the purposes below. For people in the European Economic Area, the United Kingdom and Switzerland, the second column gives the legal basis.

Where we rely on legitimate interests, we have weighed them against your rights, and you can object, as described under “Your rights”.

An email address is needed to buy on wirelens.app, to receive keys and to create an account. Device details and regular license checks are needed for paid features: without them, paid features stop and the free plan keeps working. No law requires you to give us personal data.

We do not sell personal data, use it for advertising, track you across other companies' apps or websites, or use your captures, workspace content or support files to train AI models.

7.Automated checks

To keep licenses to the limits in our Terms and to stop abuse, some decisions are made automatically:

• A key works on one Mac and up to two phones or tablets at a time. It can move to a new device up to three times in 30 days, and a Mac's security key can change up to three times in 30 days.
• An activation is refused if a device fails its security check, or if a phone does not match the one the key knows.
• On Team Cloud, a Mac is signed out if it keeps switching between networks within an hour, or if its user checks in from three or more countries in a day. An activation is refused if the same Mac already holds another person's seat in the workspace, if one seat has passed between more than three people in 30 days, or if far more people use the workspace's seats than it has.
• If our payment provider warns that a payment may be fraudulent, the keys it bought are deactivated, and a person then decides about a refund.
• The apps keep paid features off if their code has been modified, and until the next check with our service if the device's clock is set back.

When one of these applies, paid features stop on that device, and the free plan keeps working. Other signals, such as a key checking in from unusually many networks, only alert us, and a person looks at them.

8.Who we share it with

We share personal data with the companies below, only for the purposes in this policy. Cloudflare and RevenueCat process it on our behalf under data processing agreements. Link, Apple, Google and GitHub act under their own privacy policies for their own services. We share personal data only with companies bound, by contract or by their own policies and the law, to protect it at least as well as this policy does.

We may also disclose personal data:

• to the people you share with, and to your workspace's Admins, as described under “Team Workspace”;
• to professional advisers, such as lawyers and accountants, who are bound by confidentiality;
• to authorities, when the law requires it and the request is valid. Where the law allows, we tell you first. We cannot hand over traffic that never reached us or the contents of end-to-end encrypted items;
• to a company that acquires WireLens or our business, which would then be bound by this policy;
• to anyone else, with your permission.

9.Team Workspace

• Who sees what you share. Your workspace, only you, or, when Admins allow it, anyone with the link, as you choose. Admins can open every item in the workspace, including items shared as Only me.
• What Admins see. Each member's name, email address, role and last activity; the Macs, phones and tablets on the workspace's keys, with their model, system and app versions, how they signed in and the country they last checked in from; and the activity record.
• What is removed before upload. The Mac, iPhone, iPad and Android apps remove Authorization, Proxy-Authorization, Cookie and Set-Cookie headers from a capture unless you turn that off. On a Mac you can add more headers, and a session package goes up as it was exported. Rules have their secrets removed, and Compose requests their credentials and responses, by default. URLs, bodies and other headers go up as captured.
• End-to-end encryption. You can encrypt anything you share end to end, and on Android it is on by default. The key travels in the part of the link after “#”, which never reaches our servers, or as a passphrase you send separately, and we cannot read encrypted content. Its name, notes, size, number of requests, sharing settings, expiry and the label naming the device it came from are not encrypted.
• Our checks. To label a capture that is not encrypted, our server checks automatically whether credentials remain in it.
• Our access. We look at workspace content only to provide support you ask for, to investigate security problems, abuse or reports of illegal content, or when the law requires it.

10.Cookies and browser storage

We use cookies only to sign you in and to keep our services secure. We use no advertising or analytics cookies, and the cookies below need no consent because the services you use depend on them.

In your browser's storage, Team Workspace keeps the workspace you last opened, layout choices, the banners you closed and the keys of end-to-end encrypted items you opened, to save you entering them again. License Manager keeps short page notes for the length of a visit. Signing out, or clearing your browser's data for our sites, removes them.

Link and Stripe may use cookies on their checkout pages for payment security and fraud prevention, under their own policies. Because we do not track you across websites, our sites work the same whether or not your browser sends a Do Not Track or Global Privacy Control signal.

11.How long we keep it

12.Deleting your account

You can delete your WireLens account at any time:

• On the web: sign in at workspace.wirelens.app, open Account, and choose Delete account.
• On a Mac: in the Team Workspace window, open Account and choose Delete account.
• On iPhone or iPad: in Settings ▸ Team ▸ Team Workspace, open the account menu and choose Delete Account.
• On Android: in Settings ▸ Team Workspace, open the ⋮ menu and choose Delete Account.
• Or email support@wirelens.app from the address of the account.

You confirm by typing your email address and, if you signed in a while ago, by signing in again (an account that uses only passkeys finishes this on the web). Deletion takes effect immediately: we delete your account, sessions, sign-in methods, memberships, requests to join, single sign-on links and Mac seats, and any workspace where you are the only member, with everything in it. Deleted data leaves our backups within 30 days.

Some data stays after you delete your account:

• Items you shared in a workspace that has other members belong to that workspace. They keep the name you shared them under, without your email address, until the workspace's members or Admins delete them, and the workspace's activity record keeps your actions for up to 400 days.
• Invitations and anti-abuse records stay for the periods in the table above.
• We keep purchase and license records as described above, because tax and accounting law requires it. Licenses you bought keep working: deleting the account does not end them.
• Support requests stay for their retention period, unless you ask us to delete them.

If you bought the Team Cloud subscription that a workspace runs on, or you are its last Admin, hand that role to someone else, or ask us to close the workspace, before you delete your account.

To delete data that is not tied to an account, such as a support request, email us.

13.Security

• Every connection to our services is encrypted with TLS, and the apps pin the certificates of our license service.
• Sign-in codes, tokens and recovery codes are stored only as hashes, IP addresses only as keyed hashes, and authenticator and single sign-on secrets are encrypted.
• Accounts can use passkeys, authenticator apps and recovery codes, and sensitive changes need a recent sign-in.
• License answers are signed, and each device signs its requests with a key held in its secure hardware where it has one.
• You can encrypt anything you share end to end, and access to our systems is limited and logged.

No system is perfectly secure. If a breach affects your personal data, we will tell you, and the authorities, as the law requires and without undue delay.

14.Where your data is stored

Our databases and stored files are hosted by Cloudflare in data centers in Europe. Our servers run on Cloudflare's global network, where a request can be handled in a data center near you. We are based in the United States, and Link, RevenueCat, Apple, Google and GitHub process data in the United States and other countries.

When personal data from the European Economic Area, the United Kingdom or Switzerland is processed in a country without an adequacy decision, including the United States, we rely on the European Commission's standard contractual clauses and their UK and Swiss equivalents, or on the recipient's certification under the EU-US Data Privacy Framework and its UK and Swiss extensions where it has one. You can ask us for a copy of these safeguards.

15.Your rights

Wherever you live, you can ask us:

• to confirm whether we process your personal data, and give you a copy;
• to correct it;
• to delete it;
• to give you a copy of the data you provided, in a common machine-readable format, or send it to another company;
• to restrict how we use it;
• for a person to review an automated decision, and to hear your view on it.

You can do some of this yourself: change your name in your account, delete shared items and your account, release devices in License Manager, and delete captures in the app.

You can make a request through an authorized agent: we will ask for proof of their authority, and may verify your identity with you directly. If we decline a request, you can reply with "Appeal" in the subject, and a different person reviews it within 45 days.

For content in a Team Workspace, send your request to the organization that runs it. We help it answer.

Turning things off

• Stop capture, or remove the WireLens VPN or certificate in your device's settings.
• Turn off local network or notification access for WireLens in your device's settings.
• Turn off automatic update checks in the Mac app, in Settings ▸ General ▸ Updates.
• Sign out of Team Workspace, or delete your account.
• Turn off analytics sharing with app developers in your device's settings.

Turning something off does not affect what happened before.

16.Information for some regions

European Economic Area, United Kingdom and Switzerland

The controller is Routecore LLC, at the address below. The legal bases are listed under “How we use it”, and you have the rights listed under “Your rights”, including to object and to complain to a data protection authority, such as the one in the country where you live or work. In the United Kingdom, that is the Information Commission. Our data is stored in Europe and processed in the United States and other countries, as described under “Where your data is stored”.

United States

In the last 12 months we collected these categories of personal information, from the sources and for the purposes described in this policy: identifiers (such as your email address, name, device identifiers and keyed IP hashes); customer and commercial records (orders and licenses); internet activity (sign-ins, license checks and workspace activity); approximate location (country and city, from your IP address); professional information (your workspace and role); and account sign-in details, which count as sensitive information and which we use only to sign you in. We disclose them for business purposes to the companies listed under “Who we share it with”.

We do not sell or share personal information, as California law defines those words, and we have not done so in the last 12 months. We do not use sensitive information to infer anything about you. You have the rights described under “Your rights”, including to know, delete and correct, and we will not treat you differently for using them. Because there is nothing to opt out of, a Global Privacy Control signal changes nothing. We do not disclose personal information to others for their direct marketing.

Other countries

• Brazil. You have the rights in article 18 of the LGPD, including to information about the companies we share data with and to a review of automated decisions. Our data protection contact is support@wirelens.app. You can also complain to the ANPD.
• Canada. Your data is processed in the United States and other countries, where courts and authorities may access it under local law. The person responsible for privacy at Routecore LLC can be reached at support@wirelens.app. In Quebec, we use IP addresses to find the country and city of a request only as described in this policy.
• Japan. Your data is handled in the countries described under “Where your data is stored”, whose privacy laws differ from Japan's. Japan's Personal Information Protection Commission publishes information about those countries' systems.
• South Korea. As you use WireLens, your data is transferred over the internet to Routecore LLC in the United States and to the companies listed under “Who we share it with”, for the purposes and periods in this policy. You can refuse by not using the service concerned, though some services cannot be provided without the transfer.
• Turkey. You have the rights in article 11 of the KVKK, including to learn whether your data is processed, to ask for it to be corrected or deleted, and to object to a result against you that comes only from automated analysis.

17.People in someone else's capture

If your data appears in traffic someone else captured with WireLens, that person or their organization decides how it is used, and we never receive it unless they share it to Team Workspace. Please contact them first. If it is in Team Workspace, we will pass your request on to the organization that runs the workspace.

18.Children

WireLens is a tool for developers and is not directed to children. You must be at least 16 to use it. We do not knowingly collect personal data from children, and if you believe a child has given us personal data, contact us and we will delete it.

19.Changes to this policy

We update this policy when WireLens or the law changes, and the date at the top shows when it last changed. If a change materially affects how we handle your personal data, we will tell you before it takes effect: by email if you have an account or bought a license on our website, and on this page. Earlier versions are available on request.

20.Contact

Routecore LLC publishes WireLens. Write to support@wirelens.app. We usually answer within one working day.

Routecore LLC 30 N Gould St, Ste N Sheridan, WY 82801 United States