Privacy Policy

Last updated: 2026-10-17

trimix ("we") sets out this policy to explain how we handle information in the desktop app GalleonQL ("the app").

1. About this policy

This policy covers the app and the official website (galleonql.com). Services the app connects to on your behalf, such as the GraphQL endpoints you configure, are governed by their own policies.

How you buy Pro depends on your operating system. The macOS build ships on the Mac App Store and Pro is an Apple in-app purchase. The Windows and Linux builds ship from our download page, and Pro is a license key issued by our payment provider, Lemon Squeezy. Wherever that difference changes how information is handled, this policy names the operating system. Anything written without an operating system applies to all three.

2. First principle: your data stays on your machine

The app has no accounts. There is no screen that asks for your name or email address.

Everything you create — projects, collections, queries, environments, environment variables (including tokens), headers, fetched schemas and request history — is stored on your own machine, in a SQLite database named galleonql.db. None of it is synced or sent to our servers.

On macOS (Mac App Store build) it lives inside the App Sandbox, under ~/Library/Containers/jp.trimix.galleonql/Data/.
On Windows and Linux it lives in the standard app-data location for the OS, in a jp.trimix.galleonql folder.

The app shows no advertising, and it never checks for updates on its own (on macOS, the Mac App Store handles updates). The only network traffic that leaves your machine at launch is this:

macOS (Mac App Store build): the app asks Apple whether your Pro subscription is active. Our servers are not involved.
Windows / Linux: only while a license key is stored, the app checks that the key is still valid (third row of the table below).

Apart from that, the app talks to our servers only in the cases listed next.

3. What we collect, and what we do not

Applies to	What	When	Sent to	Why
All platforms	Crash reports App version; OS and CPU architecture (e.g. `macos/aarch64`) without the detailed OS version; the time it happened; the error message; its location; a stack trace; an error category; and an anonymous device ID	Only if you turn it on in Settings, and then choose "Send" on a preview screen (off by default)	Our server (AWS, Tokyo region)	To find and fix defects
All platforms	Usage analytics A predefined set of events (launch, schema import, query sent, environment created, and so on) with fixed properties such as version, OS family and outcome, plus an anonymous device ID. Which events exist is fixed in advance (see section 6)	Only if you opt in (off by default; a separate consent from crash reporting)	PostHog (EU region)	To learn which features are used, and improve them
All platforms (when using AI assist on the Pro allowance)	Confirming Pro and managing the monthly limit Purchase information — on macOS (Mac App Store build) the signed App Store transaction (a subscription record signed by Apple; it contains the product, dates, price, currency and store country and a transaction ID, but no name or email address), on Windows and Linux the license key and a device activation ID. The sentence you typed into AI assist and the candidates (type names, field names, types, descriptions, enum values) are also passed through our server to TypeSafe, the provider of Jev	Each time a Pro user builds a query with AI assist (the Pro allowance is used first, even if you have saved your own TypeSafe key). If the allowance runs out or Pro cannot be confirmed and you have saved your own key, the app sends to TypeSafe directly with that key and our server is not involved	Our server (AWS, Tokyo region), and from there TypeSafe	To confirm Pro and to manage the monthly limit. What we keep is an ID that identifies you (on macOS the original transaction ID; on Windows and Linux the license ID, or for a gifted license the ID inside the key), your usage and when your Pro entitlement ends. Usage is deleted about 400 days after the end of the month it covers, and the Pro check result 30 days after the entitlement ends. We do not store the sentence or the candidates. TypeSafe keeps the input it receives under TypeSafe's Privacy Policy (it states that it does not train models on your input; the service is hosted in the United States)
Windows and Linux only	License checks Your license key, a device activation ID and a fixed app name. No machine name or user name is sent	When you register a key, and on each launch while a key is stored	Via our server (AWS, Tokyo region), to our payment provider Lemon Squeezy	To confirm the key is valid
Windows and Linux only	Purchase records Email address, amount, product name, and order number	Only when you buy	Lemon Squeezy notifies us	To confirm the purchase and provide support. We never receive your card number

We do not collect:

Name, postal address or phone number (with no accounts, we never ask)
Your query text, endpoint URLs, headers or variable values. The analytics pipeline cannot carry them by construction — the set of fields is fixed
Anything about a purchase made on macOS (Mac App Store build). Buying, restoring and checking your subscription all happen between you and Apple, so no email address or name ever reaches us (see section 7). The only exception is the signed transaction sent when you use AI assist on the Pro allowance (table above; it includes the product, dates, price, currency, store country and transaction ID)
Card numbers — payment is handled by Apple on macOS, and by Lemon Squeezy on Windows and Linux

We do not link records across devices. Without accounts we have no way to do so.

4. The anonymous device ID

Crash reports and analytics carry a randomly generated ID (UUID) created on your device. It joins records from the same device and is not linked to your name or email address. Deleting the app's data folder generates a new ID.

The ID is a fresh random value, not something derived from your hardware. The app never reads an advertising identifier (IDFA), serial number, MAC address, host name or login name. We do not track you for advertising, we do not measure ad performance, and we never hand data to a data broker.

5. Crash reporting in detail

Off by default. Even when on, nothing is sent automatically: on the next launch the app shows the full content to be sent (including the error message and stack trace), and sends it only if you choose "Send"
The fields are fixed, as listed above; there is no free-form comment box
Because error messages can contain URLs, tokens or the user name in home-directory paths, known patterns are masked automatically. This masking does not guarantee complete anonymisation — which is exactly why you get to review the full text before sending
Received reports are stored on our server (AWS, Tokyo region) and copied into our private issue tracker (GitHub) and internal notifications (Slack) for defect management. They are never published
See the crash reporting page of the manual for details

6. Usage analytics in detail

Off by default. On first launch the app asks whether you want to help; it measures only if you agree, and you can stop any time in Settings
Only a predefined list of event types (launch, schema import, query sent, environment created, and so on) with fixed properties can be sent; unknown fields are rejected by design. Query content, endpoints, headers and variable values cannot be sent
There are 12 event types on Windows and Linux, and 9 on macOS (Mac App Store build). The three missing ones cover buying and licensing — pressing the buy button, activating a license and deactivating one — and they do not exist in the macOS build at all, because they belong to the Lemon Squeezy license-key screen, which that build does not have
Sent to PostHog's EU region (see their privacy policy)
See the analytics page of the manual for details

7. Paying for Pro

macOS (Mac App Store build)

Pro is an auto-renewable subscription sold through the Mac App Store. Buying, restoring, cancelling and checking your subscription all happen between you and Apple; our servers play no part in any of it. All the app exchanges with Apple is a product identifier and whether the subscription is active.

One exception: when you use AI assist (Jev) on the Pro allowance (the allowance is used first, even if you have saved your own TypeSafe key), the app sends the signed App Store transaction to our server to confirm Pro (table in section 3; it includes the product, dates, price, currency, store country and a transaction ID). If you do not use AI assist, the app does not contact our server (and when it sends with your own key, for example after the allowance runs out, our server is not involved).

As a result, we never receive your Apple Account, name, email address or payment method. What Apple collects from you is covered by Apple's Privacy Policy. All we see in App Store Connect are aggregate figures, such as unit counts, which do not identify anyone.

Windows / Linux

Payments are handled by Lemon Squeezy (privacy policy). The buy button opens Lemon Squeezy's checkout page in your default browser, and you enter payment details directly there. Neither the app nor we ever handle your card number.

After a purchase, Lemon Squeezy notifies us of the order (email address, amount, product name and order number). The display name you register with Lemon Squeezy — or your email address, if you set no name — is also returned to the app to label the license holder, and is stored on your own machine.

8. The endpoints you connect to

The app sends requests to the GraphQL endpoints and OAuth2 token endpoints you configure, when you tell it to. What is sent there (queries, headers, credentials) is between you and that service; we never receive it. Its handling is governed by that service's own policies.

9. Data on your machine, and how to delete it

Your working data lives in the SQLite database above. Tokens placed in environment variables are stored as-is (unencrypted), so we recommend protecting the machine itself (disk encryption, login password)
Windows / Linux: your license key and its display name are stored in the app's data. The validation cache stores only a hash of the key, never the key itself
macOS (Mac App Store build): there is no license key. Apple holds your subscription status and the app asks Apple for it at each launch, so nothing about the purchaser is kept on the machine
Deleting the app's data folder removes all of it — on macOS, ~/Library/Containers/jp.trimix.galleonql/; on Windows and Linux, the jp.trimix.galleonql folder in the OS's standard app-data location. Uninstalling alone may leave it behind

10. Sharing with third parties

On every platform, the only parties that receive anything are AWS (hosting for our server), PostHog (usage analytics, only if you opt in) and GitHub / Slack (private crash-report management). On Windows and Linux, Lemon Squeezy is added to that list for payments and license checks. On macOS (Mac App Store build) we pass Apple no information about you — the purchase is settled between Apple and you, and all the app sends Apple is a product identifier. When you use AI assist, your sentence and the candidates are passed to TypeSafe, the provider of Jev (United States). On the Pro allowance they go through our server, under our agreement with TypeSafe; with your own key they go directly, under your agreement with TypeSafe, and we do not receive them. Either way, TypeSafe states that it does not train models on your input, and its retention is governed by TypeSafe's Privacy Policy.

We do not sell data. Disclosure required by law is the only exception.

11. About these websites

The official website (galleonql.com) uses Google Analytics, through Google Tag Manager, to learn which pages are read, where visitors come from and how often the download buttons are clicked. Google Analytics stores cookies (such as _ga) in your browser and sends the pages you view, the referring site and download-button clicks, among other things, to Google.

For visitors from the EU, the EEA, the UK and Switzerland, Google Analytics is not loaded until you give consent (no cookies are stored and nothing is sent). The region is decided only from the country that our delivery network (Amazon CloudFront) determines from your IP address, and we do not store the IP address. You can withdraw consent at any time from “Analytics settings” at the bottom of the page, which stops Google Analytics and deletes its cookies (anything recorded just before you withdraw, such as a download-button click, may still be sent within a few seconds). Your choice is kept in your browser for 180 days
For visitors from other regions, Google Analytics is used from the start

The website also loads external widgets for donations (Buy Me a Coffee, Ko-fi).

The page you are reading now (trimix.jp) also loads Google Tag Manager, so that we can see how often each page is read. Each provider handles that data under its own policy.

12. Retention

Crash reports are kept for as long as needed to investigate and fix defects
Purchase records (Windows and Linux) are kept for as long as needed for support and legal obligations. On macOS we hold no purchase record at all (apart from the ID, usage and Pro end date described next)
Pro-allowance usage records (the ID, monthly usage and entitlement end date created when AI assist is used on the Pro allowance) are kept for as long as needed to manage the monthly limit
Analytics data follows PostHog's retention rules
Data on your machine is under your control and can be deleted as described in section 9 at any time

13. Children's privacy

The app is a developer tool and is not designed for children under 13. We do not knowingly collect information from them.

14. Changes to this policy

If we change this policy we will update this page and its date. We will announce significant changes on the official website.

15. Contact

For any questions about this policy or your data, contact us at .

Provider: trimix