Last updated 12 October 2026
Your infrastructure stays on your machine by default. Work Cockpit runs locally. Server configuration, credentials, schedules, logs and settings remain on this device. Server keys and infrastructure access credentials are not sent to Work Cockpit. Legacy local account passwords stay local; central customer account sign-in is described below. Optional backups are encrypted locally before transfer to your own Google Drive or direct file sharing. Managed AI is an opt-in exception for the message and server data scopes you select below.
Organization and licensing records are held in our service. Organization name and contact details, installation identifier, reported plan, app version and aggregate server/authentication counts and module names help us keep purchase and product usage records. These summaries contain no server addresses, hostnames, server identifiers, keys, passwords or local password verifiers. A reported plan is not proof of a purchase. When you link an existing subscription, we also process the address you enter, a device identifier, and Freemius subscription and installation identifiers so we can verify the purchase, manage its device activation and refresh its entitlement.
Central customer accounts. When you create or link a customer account, workcockpit.com receives your verified email and account password over HTTPS. The service stores your email address, a salted password verifier and hashed session identifiers; it does not retain the plaintext password. Email verification is required to create an account or reset its password. Sessions expire after 30 days and password reset revokes existing sessions. The native app keeps its session credential in the operating-system keychain. Signing in does not upload your local workspace or grant a subscription. Existing local users remain local until explicitly linked; an unrelated account cannot open an existing workspace. Older cloud account records are separate and are not used by this customer account service.
Apple and Freemius process purchases. An Apple subscription can be linked to the Windows edition using Apple's signed transaction; a vendor relay cannot issue or change an Apple entitlement. Apple sign-in may pass its signed token through a short-lived post box; the app verifies Apple's signature and the nonce for the current attempt before unlocking an existing local account.
An existing Freemius subscription can also be linked to another device after the owner verifies the purchase email. This checks the existing subscription and does not start a purchase or reset a trial.
To link an existing Work Cockpit subscription, the address and one-time code pass through workcockpit.com and the email delivery service configured for us. The code expires after ten minutes and can be used once. We store HMAC-protected address, code and session values, plus device and Freemius licence/install identifiers and link status; we do not store the email-link refresh token or licence key in the website database. The app keeps the linked address and refresh token in the operating-system keychain. The device link expires after 30 days and must then be verified again.
Support tickets send the subject, description, category, plan and organization name you provide. Infrastructure details should not be included in a ticket unless you intend to share them with support.
Optional managed AI. If you choose Work Cockpit AI, your message and only the server identity, metrics or command output scopes you select pass through our AI gateway to the named OpenAI API model. SSH credentials and private keys stay on your device. Work Cockpit does not save prompts or replies on its server. OpenAI handles submitted content under its API data policy; default abuse-monitoring logs may include prompts and responses and are retained for up to 30 days, subject to legal and safety exceptions. We do not represent that OpenAI Zero Data Retention is enabled. See the OpenAI API data controls. BYOK AI messages go directly to the provider you configured, under that provider’s data policy.
We cannot read the local configuration, credentials or event log. Managed AI is an optional exception for the message and scopes you actively select; see the AI section below for the gateway and provider data handling.
Only where you point it: your own servers over SSH, VNC or RDP; the Cloudflare API with your own token; a public RDAP registry to read a domain's expiry date; your own SMTP server if you configure mail alerts; and, only when you opt in, Work Cockpit’s AI gateway and the named upstream AI provider. AI prompts and selected context go to that provider; SSH keys and credentials stay local.
Purchase, account and support services:
Connecting Google Drive is optional and off until you do it. It exists for one job: keeping a copy of your encrypted backup bundle somewhere other than this machine.
Work Cockpit's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not transfer this data to anyone, do not use it for advertising, and do not allow humans to read it.
On the Pro plan, one person's Mac can serve its fleet to colleagues. That connection goes directly from their machine to yours — there is no relay, no cloud channel between installations, and we are not in the path. We are not told that a team exists, who is in it, or what it reaches.
When an administrator grants write access with a connection feature, the credential for that server travels from the administrator's machine to the colleague's, because that is what being granted access means. It goes nowhere else. We never receive it, never store it, and could not read it if we did — the transfer is encrypted end to end between those two machines.
The marketing site sets one browser storage item, wcsite.theme, to
remember whether you chose the light or dark theme. It is not a tracking cookie and
it never leaves your browser. There are no third-party scripts, no ad or analytics
tags, and no embedded content from other sites.
If you become a customer or open a support ticket, we keep what that requires: your name, email, company and country; which licence you hold; a record of payments (amount, date, method and reference — we never see or store card numbers); and the contents of your tickets. This is stored in Cloudflare D1 in the European Union and is used to provide the product and support it, including payment processing, licence verification and email delivery. It is not used for marketing or sold.
Ask us for a copy of what we hold about you, a correction, or deletion, and we will act on it. Deleting a customer record removes its licences, payment records and tickets with it. Write to [email protected].
If this policy changes in a way that affects what we collect, the date at the top changes with it.
Kuvarssoft Teknoloji LTD. ŞTİ. · [email protected]