Privacy.

Who holds it

SMEPoint LLC, the publisher of Carvect Pro. Write to support@smepoint.com about anything on this page.

What an account holds

Your email address, a name if you gave one, and the date you registered. Your password is stored only as a scrypt hash — we cannot read it, and a reset replaces it rather than recovering it.

Against your license we hold the key, the plan, how long updates run, and the seat limit.

What the application sends

When it checks your license it sends your account token, a device id and a device name. That is the whole of it.

The device id is a one-way hash of an identifier your operating system already keeps for that computer — IOPlatformUUID on macOS, MachineGuid on Windows. The original never leaves your machine. What we hold answers exactly one question — is this the same computer as last time — and cannot be turned back into the value it came from, or matched against what any other software sees.

We derive it rather than rolling a random number for a plain practical reason: reinstalling your operating system should not cost you one of your two seats. It used to, and that was our bug to fix, not yours to work around. Where no such identifier can be read, a random number is generated once instead, and the application tells you so.

The device name is your computer's own hostname, so you can tell the two computers on your license apart in a list.

This happens when you activate a computer, and then stops. A licensed copy does not check in with us again: it verifies the license it already holds, on your computer, and we learn nothing about when or whether you are using it.

What it does not send: your drawings, your models, your toolpaths, your G-code, your tool library, your machine settings, or any record of what you cut. None of that leaves your computer. There is no usage telemetry and no crash reporting.

Buying

Payment is handled by Paddle.com Market Ltd as merchant of record. We never see your card details — they go to Paddle and not to us — and Paddle handles your payment data under its own privacy policy, as a data controller in its own right.

What we keep afterwards is the order record: a number, what was bought, the amount, the tax, the currency, the payment reference, and the billing name and address that came back with the sale. That is what an invoice needs.

This website

No analytics, no advertising, no third-party trackers, no cross-site cookies. Nothing here is measuring you, and no advertiser is told you came.

Nothing on these pages is loaded from anybody else's server — not even the typefaces, which are served from here rather than from a font host, so that loading a page tells no one but us that you did. The server is configured to refuse an outside source outright, and a test holds it to that.

One cookie: a session cookie that remembers you are signed in. It is HttpOnly and SameSite, so it is not readable by script and is not sent from other sites. Signing out clears it.

The server keeps ordinary web logs, which include IP addresses. They are used to keep the service running and to rate-limit sign-in attempts — counting failed guesses is the only thing that makes a password hash worth having.

Email

We email you about your account and your purchase: a password reset when you ask for one, and what you bought when you buy it. We do not send marketing email.

Keeping it, and getting rid of it

The account and its license stay while the license does — a perpetual license is not much use if we forget who owns it. Order records are kept as long as tax and accounting rules require.

Ask us and we will tell you what we hold, correct it, or delete the account. Deleting the account ends the license with it, so we will say so before doing it rather than after.