Privacy, in plain English
Short version: what you do in the app stays on your device. We keep the least we can to sell you a ticket and stop it being shared.
Last updated: [date]. This page needs a solicitor's review before launch.
The app
Your files, chats, searches, folder lists and location stay on your computer. The AI runs on your computer too. The search index and your saved chats are encrypted on your device. You can delete chats at any time, or have them deleted automatically after 7, 30 or 90 days. File reading happens in a separate helper program that has no network code.
The app only goes online for these things, and nothing else:
- Activating your ticket with our server (api.workoffline.ai). It sends your ticket code (it holds your ticket number and the email address you bought it with), a random device ID made by the app (a public key, no hardware details), and the app version.
- Checking for and downloading updates from our server (api.workoffline.ai). Update checks send only three things: your ticket ID (for example WOTT-7K3F-Q9XM-2HDA, not your ticket code), this device's public key, and the app version. Our server answers with whether an update is available, the ticket's status (valid, refunded, or device removed) and an up to date copy of your ticket code, so upgrades reach the app. The app checks for updates at most once a day while you're online, never while Offline lock is on, and you can switch the daily check off in Settings. Updates are signed, and the app checks the signature before installing.
- Downloading AI model files from our own organisation on Hugging Face (huggingface.co/WorkOffline and its download network), where the open model files are hosted, or from our own download server (dl.workoffline.ai) for model and map pack files. This is a plain file download. Hugging Face sees your IP address, like any website you visit, under its own privacy policy.
If you use it free, with no ticket
Press "Skip for now" on first run and the app makes no calls to our servers at all: no activation, no update check, no account. The only connection is the free AI model download from Hugging Face, described above, and nothing at all with Offline lock on. To update the free app, you download it again from workoffline.ai. We don't know you have it.
If you have Pro
Pro features work offline using a signed Pro pass, a small file that says your ticket is on Pro until a certain date (about 5 weeks ahead). The app gets a fresh pass during its normal update check, the same request described above. Nothing new is sent: no extra connection, no extra data, and nothing about how you use Pro features. If you cancel Pro, the next update check simply stops sending new passes. If you switch update checks off or keep Offline lock on, Pro features pause when the pass runs out. Everything else keeps working.
The app has no analytics, no crash reporting and no tracking. The Network activity page lists every connection it has ever made, and the Offline lock switch blocks all of them, including update checks. If something goes wrong, the app shows you the diagnostics so you can choose to copy and send them to us yourself.
If a ticket is refunded or a device is removed from it, the app finds out only from its next update check or download. It never connects just to check your licence. Chat and compression then switch off on that laptop, while your files and chats stay where they are. A laptop that never goes online, or always has Offline lock on, keeps working as it is.
This website
This covers workoffline.ai, where you buy tickets and manage your account. WorkOnTheTrain.com and WorkOnThePlane.com are our information sites. They link here to buy or sign in and [confirm before launch: follow the same rules, with no cookies and no analytics].
- No analytics, no advertising, no tracking scripts, no third-party fonts. The fonts are served from our own site.
- No cookies, except one session cookie when you sign in to your account. It is needed to keep you signed in and ends after 30 days or when you sign out.
- The "Will it run on my laptop?" check runs in your browser. Nothing about your device is sent to us.
- If you pick light or dark mode by hand, that choice is saved in your browser only.
- Pages fetch the current flat white price from our server (api.workoffline.ai). That request carries no personal information.
What we store about you
| What | Why | How long |
|---|---|---|
| Your email address | Your account, ticket email and sign-in links | Until you delete your account |
| Your tickets and payment records (amount, date, Stripe reference, and the date of any refund), and for Pro your subscription status, plan, locked price, trial end and renewal date | To provide what you bought, the free trial and its reminder email, renewals, refunds, tax records | Until you delete your account. Stripe keeps payment records as the law requires. |
| Your devices: a random device ID, the device's public key, an optional name you choose, laptop or mobile, the country, app version and dates | Device limits (Single 1, Season 2, Pro 5) and swap limits, to stop tickets being shared | Until you remove the device or delete your account |
| A coded (hashed) copy of your email address if you start a Pro free trial, made with a secret key, that can't be turned back into your address | So each person gets one free trial | Kept after you delete your account, so the trial can't be repeated. It holds nothing else. |
| Reminder email and time | To send the one reminder you asked for | Deleted as soon as it is sent |
| Product news opt-in, with where and when you agreed and the wording you agreed to | Only if you ticked the box and then clicked the link in our confirmation email, or ticked it when buying a ticket | Until you unsubscribe. Every news email has a one-click unsubscribe link. Unconfirmed sign-ups are deleted after 7 days. |
| Anti-abuse counters for our sign-up forms | To stop people flooding the forms. Each counter is a scrambled code made with a random key that changes every day, never your IP address or email | Up to a day. Each day's key is deleted after 2 days, so old codes can't be traced to anyone. |
We never store your IP address. Cloudflare, which runs our servers, sees it while delivering each request and tells us only the country. We don't store your name, card details or anything about what you do in the app.
Who else is involved
- Stripe takes your payment, runs Pro subscriptions and free trials, makes refunds, runs the billing page where you manage or cancel them, and works out VAT and sales tax. Your card details go to Stripe, never to us. Stripe only saves your card for later upgrades if you tick the box at checkout, and a Pro trial needs a card on file so the first charge can be taken if you stay.
- Postmark sends our emails from workoffline.ai (tickets, sign-in links, reminders, and the email 2 days before a Pro trial's first charge). Open and click tracking is switched off.
- Cloudflare hosts this website (workoffline.ai), our marketing sites (workonthetrain.com and workontheplane.com), our server (api.workoffline.ai) and the downloads (dl.workoffline.ai).
- Hugging Face hosts the AI model files the app downloads.
Your rights
You can see, correct or delete your data at any time. Signed-in customers can delete their account from the Delete account page, which removes your account, tickets and devices from our database straight away, and cancels any Pro subscription. For anything else, email [[email protected]]. If you're unhappy with how we handle your data, you can complain to the Information Commissioner's Office (ico.org.uk).
Legal basis: we use your data to fulfil our contract with you (tickets, devices, downloads), with your consent (product news, reminders), and for our legitimate interest in stopping tickets being shared (device and swap limits).
Who we are
WorkOffline is run by [company name], [registered address], company number [number], VAT number [VAT number]. Contact: [[email protected]].