Privacy Policy
Privacy is the point of everything built here, so this policy is short and plain. No tracking cookies, no analytics scripts, no ads, no telemetry in the software. Here's exactly what little is collected, why, and for how long.
Effective 17 October 2026 · Last updated 17 October 2026 · See also the Terms & Legal page
Summary
| What | Collected? | Details |
|---|---|---|
| Tracking / advertising cookies | No | The public site sets no cookies at all. |
| Analytics scripts (Google Analytics etc.) | No | Visitor statistics come only from the web server's own logs, with IP addresses anonymised in reports. |
| Web server logs | Yes | IP address, time, page, browser details. Kept up to 365 days for security and statistics. |
| Bug reports | Only if you send one | What you type in the form, plus any files you attach (metadata stripped). Your IP address is not stored with it. |
| Telemetry in WhisperDesk / CaseKeeper | No | The apps never send your data anywhere unless you choose a feature that does (explained below). |
| Selling or sharing data | Never | No data is sold, rented or used for advertising. |
Who we are
"DarkCipher Systems", "we", "us" and "our" refer to DarkCipher Systems, run by Luke (DarkCipher0x), an individual based in London, United Kingdom. We are the data controller for personal data collected through darkciphersystems.com.
Contact for anything privacy-related: . We handle personal data in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Visiting the website
Like almost every website, our web server (nginx) automatically records each request in its access log:
- your IP address;
- the date and time, the page or file requested (including downloads), and the response status;
- your browser's user-agent (browser and operating system) and the referring page, if your browser sends it.
Why: to deliver the site, keep it secure (for example detecting and blocking attacks), fix problems, and produce aggregate visitor statistics (pages viewed, downloads, browsers, referring sites).
Lawful basis: our legitimate interests in running a secure, working website and understanding how it is used (UK GDPR Article 6(1)(f)).
Statistics: visitor statistics are generated on our own server with GoAccess. IP addresses are anonymised in those reports (the last part of the address is removed), known bots are excluded, and nothing is sent to any analytics company.
Security: we use fail2ban, which reads the logs and temporarily blocks IP addresses that show abusive behaviour (for example repeated login attempts, scanning for vulnerabilities or flooding forms). Blocks last between one hour and one week.
Bug reports
If you use the bug report form, we store what you enter: product, version, type, summary, steps, expected and actual behaviour, Windows version, hardware, whether it's a security issue, and, only if you provide it, your email address so we can reply.
- Your IP address is not stored with your report. It is used only momentarily to limit how many reports can be sent at once (anti-spam), and appears in the ordinary web server log like any other request.
- Reports are stored on our own server and read only by the site owner. They are not emailed, and not shared with anyone or sent to any third-party service.
- Attachments (optional): up to 3 screenshots or files (PNG, JPEG, WebP, GIF, PDF or plain text, 5 MB each). They're stored on the same server under random file names, with hidden photo metadata (EXIF, GPS location, camera details, embedded text) removed on arrival. They're deleted together with the report.
- Lawful basis: legitimate interests in fixing and improving the software; where you add your email, also your choice to be contacted.
- Please don't include court documents, recordings or other personal details in a report.
Email & Discord
Email: if you email , we receive your email address, name (if shown) and message, and use them only to reply. This mailbox is provided by Google (Gmail), which processes the messages as our email provider.
Discord, Twitch, YouTube, TikTok and Instagram: these are third-party services with their own privacy policies. If you contact us or interact there, that platform's terms apply.
Twitch embed & external links
The Gaming page can show a live Twitch player and chat. It is click-to-load: until you press "Load stream & chat", your browser makes no connection to Twitch. Once you load it, Twitch (Amazon) receives your IP address and may set cookies under the Twitch Privacy Notice. The lawful basis is your consent, given by clicking, and you can avoid it by not loading the player.
Links to other websites (Twitch, YouTube, Discord, Microsoft and so on) take you to services we don't control. Their own privacy policies apply.
The software (WhisperDesk & CaseKeeper)
Our apps are built to work entirely on your own computer. They contain no telemetry, analytics, crash reporting, accounts or ads, and we receive nothing from them. Your recordings, transcripts, voiceprints, documents and notes stay on your PC.
The only network activity happens when you use a feature that needs it:
- WhisperDesk: downloading speech models you select (from huggingface.co / github.com); AI summaries through an Ollama server you configure (by default on your own PC); add-ons you enable, such as a webhook to a URL you choose; and the Windows share sheet when you press Share.
- CaseKeeper: makes no internet connections at all.
Because the data never reaches us, you are the controller of anything you process with the apps, such as recordings of other people or voiceprints, which can count as biometric data. Please make sure you have the right to record and process it, and follow local recording-consent laws.
How long data is kept
| Data | Kept for |
|---|---|
| Web server access logs (IP, time, page, browser) | Up to 365 days, then automatically deleted |
| Aggregate statistics (IPs anonymised) | Rebuilt from the logs; covers the same 365-day window |
| Security (fail2ban) logs | About 4 weeks |
| Security blocks on an IP address | 1 hour to 1 week, depending on the behaviour |
| Bug reports & attachments | Until the issue is resolved and the report is no longer needed, then deleted. You can ask for earlier deletion. |
| Emails | As long as needed to deal with your message |
| Backups of the server configuration and site | Contain no visitor data |
Security
The site uses HTTPS everywhere with modern TLS, strict security headers and a content security policy, rate limiting, and fail2ban intrusion prevention. Administrative access is restricted and protected by multiple layers of strong authentication. Logs are readable only by the server's administrators. No system is perfectly secure, but we take reasonable steps proportionate to the small amount of data involved.
Found a vulnerability? Please report it privately. See our security.txt or use the bug form and tick "security issue".
Your rights
Under UK data protection law you have the right to:
- access the personal data we hold about you;
- have it corrected if it's wrong, or erased;
- restrict or object to how we use it (including use based on legitimate interests);
- data portability, where applicable;
- withdraw consent at any time where we rely on it.
To use any of these rights, email . Because server logs aren't linked to names, we may need details such as your IP address and the approximate time of your visit to find the right records. We'll respond within one month.
If you're unhappy with how we've handled your data, you can complain to the UK regulator, the Information Commissioner's Office, at ico.org.uk. We'd appreciate the chance to sort it out first.
Children
The website and software are not directed at children under 13, and we don't knowingly collect their personal data. The Twitch chat on our streams is 18+.
Changes to this policy
If how we handle data changes, we'll update this page and the "Last updated" date. Significant changes will be highlighted on the site.