Privacy Policy

Last updated: 2026-10-01

1. Who is responsible

The controller for the processing described here is the operator of DeviceShelf named in the Imprint. Questions and data-subject requests: privacy@deviceshelf.app.

2. The short version

DeviceShelf is a local-first network scanner. Your scan results — the devices on your network, their addresses, open ports and any notes — are stored only on the device that ran the scan. There is no DeviceShelf account, no DeviceShelf cloud, and the app contains no analytics or telemetry. Personal data is only processed for the few things a paid product genuinely needs: selling a licence, delivering it by email, answering your messages, and serving the website and downloads. Those are described below.

3. The app: scan data & telemetry

Scan data stays on your device. It is never transmitted to us. You can export it (JSON, CSV, XML, HTML, PDF) or delete it at any time. Licence verification runs offline via an ed25519 signature — the app does not phone home to check your licence.

Telemetry: none. The app does not report what you scan, what it finds, or that you launched it.

Optional features that send data — only if you enable them. These are off by default and run on your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time by turning the feature off again; the data then goes straight to the third party you chose, never through us:

• AI features: if you add your own API key, the app asks for your permission before any cloud AI request. It identifies the recipient and endpoint, then sends your prompt and the relevant device or network signals directly from your device to the provider you chose — Anthropic, OpenAI, Azure OpenAI, OpenRouter, Mistral, Groq, Google Gemini, or a local Ollama model. Those signals may include IP addresses, pseudonymised MAC addresses, host/device names, vendors, open ports, service banners, certificate names, OS hints and security findings. We never see or proxy them; the provider's terms and privacy policy apply.
• Fingerbank lookup: if enabled, a device's DHCP fingerprint may be sent to fingerbank.org to help identify it.
• WAN-IP info & speed test: on demand (button press), a request goes to Cloudflare to determine your public IP or measure your connection speed; for the WAN view, your IP's network details (ISP/ASN, approximate location) are then looked up via the RIPE NCC's open data API (stat.ripe.net).
• Traceroute hop geolocation: only if you enable the clearly-labelled option in the traceroute panel, the public router IPs of your route are sent to the RIPE NCC's open data API (stat.ripe.net) to show each hop's network and location.
• Webhooks: if you configure a webhook URL, event data (device name, MAC, event type) is posted to that endpoint of your choice.

DNS fallback: when one of the features above is used and your system's DNS resolver is unreachable (e.g. a broken VPN), DeviceShelf falls back to DNS-over-HTTPS at Cloudflare (1.1.1.1) to resolve that feature's hostname. This happens only in the context of a feature you triggered — never on its own.

Don't trust us — verify it

With every opt-in feature turned off, DeviceShelf never connects to a DeviceShelf server on its own — no telemetry, no automatic update check, no license check, no analytics. License verification is offline (ed25519). The CVE hints and vendor names in the security report come from data bundled in the app (refreshed only when you update the app), so they make no network calls either.

The update check is the one exception — and it contacts our own server, deviceshelf.app. It runs only when you click "Check for updates" or enable the optional on-launch check (off by default). Even then it just fetches a small static version file — no identifier, no current-version report, no analytics — and we never auto-download or auto-install; you're notified and download the signed installer yourself.

What a packet capture will show — and what it means:

• Local scan traffic. DeviceShelf is a scanner, so it opens many connections to devices on your own network (ping/port sweeps, mDNS, SNMP…). That traffic stays within your LAN.
• DNS lookups go to whatever resolver your system is configured to use (possibly on the internet, e.g. your router or 1.1.1.1). That is your network's resolver, not a DeviceShelf endpoint.
• OS / WebView traffic. The app uses your operating system's built-in web view (WKWebView on macOS, WebView2 on Windows). The OS may make its own certificate/OCSP or vendor calls — that is macOS/Windows, not DeviceShelf.
• The only data that reaches the internet from DeviceShelf is from an optional feature you switch on or trigger — AI device-ID (to the provider whose key you supplied), Fingerbank, WAN-IP info / speed test (Cloudflare), traceroute hop geolocation (stat.ripe.net), or a webhook you configured — and it goes straight to that service, never through us. The sole exception is the update check you run or enable, which fetches a static version file from deviceshelf.app.

Check it yourself with a per-app firewall (Little Snitch, or the free LuLu), or a capture filtered to non-local destinations:

sudo tcpdump -n 'not (net 192.168.0.0/16 or net 10.0.0.0/8 or
  net 172.16.0.0/12 or net 169.254.0.0/16 or net 224.0.0.0/4 or host 127.0.0.1)'

Launch DeviceShelf with opt-in features off — it starts a scan of your own network automatically. Expected result: plenty of local LAN traffic, but nothing to deviceshelf.app or any other non-LAN destination beyond the OS/WebView/DNS noise above — unless you click "Check for updates" or enabled the optional launch check. If DeviceShelf otherwise phones home with opt-ins off, that is a bug — please report it.

4. The website & downloads

Hosting & server logs. The website, our API endpoints and the download files are hosted on Cloudflare. To deliver content and defend against attacks, Cloudflare processes connection data (including IP address, request time and user-agent) in short-lived server/security logs. Legal basis: our legitimate interest in a secure, functioning service (Art. 6(1)(f) GDPR; Art. 31(1) Swiss FADP).

No cookies, no cross-site tracking. deviceshelf.app sets no cookies and embeds no third-party trackers. It does keep a few small entries in your browser’s own storage. None of them is a visitor ID, none is shared with another site, and you can delete all of them by clearing the site data for deviceshelf.app.

Kept until you delete them (localStorage), because you asked for them:

• lang — the interface language you picked.
• ds_checklist_v1 — the boxes you ticked on the security checklist page.
• dspoll_… — that you already voted in a feature poll, so the page shows the results instead of the buttons.
• ds_optout — set only if you open a page with ?dsopt=out (we use it to keep our own visits out of the statistics).
• ds_consent — your answer to the statistics question (see your consent below), so we do not ask again. It holds “allowed” or “declined” and nothing else.

Kept only until you close the tab (sessionStorage):

• dsfresh_… — makes sure the page reloads once, and only once, after we publish a new version.
• ds_pay_pending — set on the thank-you page while your SEPA direct debit is still being collected, so the page keeps saying so after a reload.
• For the conversion statistics described below: the one-word traffic source (for example google), the campaign name and ad variant of the link you came from, the page your visit started on, and yes/no markers that an event was already counted in this visit (visit start, trial click, download, checkout start, return from checkout). Without them a buy click two pages later could not be matched to the campaign that brought you, and every reload would count as a new visit.

Your consent (EU/EEA). The statistics entries are not needed to use the site. If you visit from the EU or the EEA, the conversion statistics described below run only after you press Allow in the bar at the bottom of the page. Until then, and if you decline or close the bar, no statistics event is sent and none of these entries is written. To know whether to ask, the page asks Cloudflare, on this site’s own address (/cdn-cgi/trace), which country your connection comes from; the answer is used once and not stored. If the country cannot be determined, we ask. Outside the EU/EEA the statistics run without the question. Giving consent is voluntary. You can give or withdraw it at any time: Statistics settings Withdrawing stops the statistics at once, in every open tab, and deletes the entries from the tab. With Do-Not-Track or Global Privacy Control turned on, nothing is measured and nothing is written, wherever you are.

Download statistics. When you download an installer we record an anonymous, aggregate entry — date, platform, version and a coarse country — to understand demand. We deliberately store no IP address, no user-agent and no other identifier, so this is not personal data. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).

Conversion analytics (cookieless). To understand whether the site actually works — how many visitors reach the pricing page, start a checkout and complete a purchase — we record a handful of anonymous, aggregate events (a page view, a trial-download click, a buy click and a checkout start) and send them to our own Cloudflare Worker. We store no cookies, no IP address, no user-agent, no fingerprint and no persistent visitor identifier — only a coarse count per day, page, language, country, traffic source, campaign, ad variant (with or without a price), and whether the browser window was narrow (phone-width) or wide. That last one is derived from the window width alone — never from the user-agent — so it says which layout you were shown, not which device you own, and it cannot single anyone out. The traffic source is a single word from a fixed list: google, reddit, direct, or referral for a site we make no attempt to name. It comes from the campaign link you followed, or otherwise from the address of the site that linked you, which is itself never stored. Nothing ties one event to another: there is no session or checkout identifier, and the completed-purchase event is generated on our server from the payment webhook, never in your browser. We honour Do-Not-Track and Global Privacy Control — if either is enabled, nothing is sent and nothing is written to your browser. The tab-scoped entries this uses are listed above. Legal basis: in the EU/EEA your consent (§ 25(1) TDDDG and Art. 5(3) ePrivacy Directive; Art. 6(1)(a) GDPR), which you can withdraw at any time with effect for the future; elsewhere our legitimate interest in operating and improving the service (Art. 6(1)(f) GDPR; Art. 31(1) Swiss FADP).

Embedded videos (YouTube). Some pages show a video from our YouTube channel. Until you press play, the page shows only a picture stored on our own server, and nothing is loaded from Google. When you press play, the player is loaded from www.youtube-nocookie.com, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. From then on Google receives your IP address and the address of the page, and may store data in your browser. Google is responsible for that processing (see Google's privacy policy); data may be transferred to the USA under the EU-US Data Privacy Framework. Legal basis: your consent, given by pressing play (Art. 6(1)(a) GDPR; § 25(1) TDDDG). If you prefer, watch the videos on YouTube directly instead.

5. Contact form

If you use the contact form we process the name, email address, topic and message you enter, in order to receive and answer your request. Spam is filtered by a simple server-side method (a hidden “honeypot” field) — there is no CAPTCHA, no third-party anti-spam service and no tracking. Your message is relayed to our support inbox via our email provider (Resend); we do not store it in a database. Legal basis: steps prior to / performance of a contract and our legitimate interest in answering enquiries (Art. 6(1)(b) and (f) GDPR; Art. 31 Swiss FADP). We keep the correspondence only as long as needed to handle your request and any follow-up.

6. Newsletter, blog & feature polls

If you subscribe to our update list — on the blog or from the download screen — we process your email address to send you product news (new releases, features and the occasional poll). If you opt in from the download screen, you first get a short setup series over your first week, then only occasional release news. We use double opt-in: after you enter your address we email you a confirmation link, and you are only added once you click it — an unconfirmed address is discarded automatically. The subscriber list is stored by Cloudflare (Workers KV); emails are sent via Resend. We do not use open or click tracking: our emails carry no invisible tracking pixels, and links point straight to deviceshelf.app. Every email contains a one-click unsubscribe link, and you can opt out at any time. Legal basis: your consent (Art. 6(1)(a) GDPR; Art. 6 Swiss FADP), which you can withdraw at any time with effect for the future. We keep your address only until you unsubscribe.

Blog feature polls let you vote with a single click and no account. To stop one person voting many times we store a one-way hash of your IP address together with the poll id (so we can recognise a repeat vote without ever storing your IP itself); we keep only anonymous per-option tallies. Legal basis: our legitimate interest in a usable, non-stuffable poll (Art. 6(1)(f) GDPR).

7. Buying a licence

Checkout and payment are handled by Dodo Payments as our Merchant of Record (see Imprint). Dodo Payments collects the data needed to process the order and issue an invoice (e.g. email, billing and payment details) under its own privacy policy. We receive your email address, which our licence service (a Cloudflare Worker) uses to generate and email your licence via Resend, and the country of your billing address, which decides whether that email is in German or English and in which language the purchase is counted in our anonymous daily totals. If you answer the optional question how you heard of DeviceShelf, the answer is counted in such a total too. The payment's reference number is stored with your licence record, so that a repeated notification from Dodo Payments sends the same licence again instead of a second one. Legal basis: performance of a contract (Art. 6(1)(b) GDPR). We retain purchase email and licence records as required for accounting and warranty purposes.

8. Processors & recipients

We use the following service providers, acting as our processors under Art. 28 GDPR where applicable. Where a provider is based outside Switzerland/the EEA, the transfer is safeguarded by the EU Standard Contractual Clauses and, where the provider is certified, the EU-US Data Privacy Framework. You can request a copy of the relevant safeguards from privacy@deviceshelf.app.

9. Retention

We keep personal data only as long as necessary for the purpose it was collected, or as long as statutory retention periods (e.g. for invoices) require. Anonymous download statistics contain no personal data and are kept indefinitely in aggregate.

10. Your rights

Under the EU GDPR and the Swiss Federal Act on Data Protection (FADP) you have the right to access, rectification, erasure, restriction, data portability and to object to processing based on legitimate interests. Where processing is based on your consent, you may withdraw it at any time with effect for the future, without affecting the lawfulness of prior processing. To exercise any of these, email privacy@deviceshelf.app.

You also have the right to lodge a complaint with a supervisory authority — in Switzerland the Federal Data Protection and Information Commissioner (FDPIC/EDÖB), or your local EU/EEA data-protection authority.

11. Automated decisions & profiling

We do not carry out automated decision-making producing legal or similarly significant effects (Art. 22 GDPR), and we do not create personality or behaviour profiles. The optional in-app AI features identify devices, not people. The service is not directed at children.

12. Changes

We may update this policy as the product evolves. The date at the top reflects the latest version.

Contact

See the Imprint for legal contact details.