Privacy

The short version

SchemaGhost is a macOS app that edits and versions prompt files on your Mac. Your prompts, snapshots, and fixtures never leave your machine. The only outbound network calls are:

• You press “Run test.”SchemaGhost sends the request to Anthropic or OpenAI using your own API keys. We don’t see it.
• App updates. The app fetches a Sparkle appcast feed (an XML file listing released versions) over HTTPS. No identifier is attached.
• License activation. When you activate a license, the app contacts the Lumen license server once to verify the key, then re-verifies every 60 days. It sends your license key and email — nothing else.

No analytics, no telemetry, no crash reporting, no in-app event tracking in V1. The app does not phone home on launch.

What lives on your Mac

• Your prompt templates. Flat .prompt.md files (YAML frontmatter + Markdown body) in the root folder you picked during onboarding. SchemaGhost reads and writes them through a macOS security-scoped bookmark — it only ever touches the folder you authorised.
• Auto-snapshots. Every save writes an immutable copy to <project>/.schemaghost/snapshots/<template>/<timestamp>.md. You can compact, restore, or delete these from Settings → Storage.
• Fixtures. Named test inputs at <project>/.schemaghost/fixtures/<template>/.
• Snapshot index. A small JSON cache at <project>/.schemaghost/index.json so the history view is fast.
• Preferences. Standard macOS NSUserDefaults for window state, recent selections, theme, font scale, update channel.

None of these files are uploaded anywhere. They live exactly where you put them on disk.

API keys

API keys you paste in Settings → API Keys are written to the macOS Keychain under service id works.lumenlabs.schemaghost.apikeys. They are never written to disk, NSUserDefaults, log files, or snapshot files.

When you press “Run test,” SchemaGhost reads the relevant key from Keychain at that moment, sends the request directly to the provider (Anthropic api.anthropic.com or OpenAI api.openai.com), and discards the key from memory when the request finishes. We never proxy provider traffic through our infrastructure.

License server

When you enter a license key, SchemaGhost makes a single HTTPS POST to licenses.lumenlabs.works/v1/verify with two fields: the license key and (optionally) the email associated with the purchase. The server replies with a signed receipt that is stored in your Keychain for offline use.

The app re-verifies the receipt approximately every 60 days. If you go offline indefinitely, the cached receipt continues to work for that window. If your key is revoked (e.g. refund), the next verification removes it.

We do not log IP addresses, machine identifiers, or app version in license calls. The license endpoint logs only what is needed to fulfil entitlement checks and to detect abuse.

Automatic updates

SchemaGhost uses Sparkle to deliver updates. The app periodically fetches updates.lumenlabs.works/schemaghost/appcast.xml (stable) or appcast-beta.xml (beta) over HTTPS. The request carries no identifier — it is a plain GET that any browser could make. You can disable automatic checks in Settings → Updates.

Update bundles are EdDSA-signed by Lumen Labs. Sparkle verifies the signature before installing.

What we do not collect

• No analytics SDK. No Firebase, Amplitude, Mixpanel, etc.
• No crash reporter. (macOS’s own crash reports stay between you and Apple.)
• No referrer, install attribution, or session pings.
• No content scanning of your prompts.
• No background uploads, period.

Cookies and the website

This subsite (schemaghost.lumenlabs.works) is a static page served by Cloudflare Pages. It sets no cookies and runs no analytics scripts. Cloudflare may log standard edge metadata (IP address, user-agent, request path) for abuse prevention. We do not access or retain that.

Your rights

Because we hold no personal data from app usage, there is effectively nothing to access, port, or delete on our side.

For license-related data (purchase email, license key) and the umbrella corporate policy (GDPR / India DPDP Act controller information, data-subject request process), see the Lumen Labs privacy policy. SchemaGhost is operated by the same entity (NOVA-LUMEN LABS LLP).

To delete a license record on our side, email [email protected] from the address you purchased with. We process requests within 30 days.

Changes to this policy

If we materially change how SchemaGhost handles data, we will update this page and bump the “Last updated” date. Substantive changes will also be called out in the release notes for the version that introduces them.

Contact

Questions about SchemaGhost or this policy: [email protected].