Privacy Policy

Last updated: 2026-08-19

trimix ("we") provides this policy for the desktop app GalleonQL ("the app").

1. About this policy

This policy covers the app and the official website (galleonql.com). Services the app connects to on your behalf, such as the GraphQL endpoints you configure, are governed by their own policies.

2. First principle: your data stays on your machine

The app has no accounts. There is no screen that asks for your name or email address.

Everything you create — projects, collections, queries, environments, environment variables (including tokens), headers, fetched schemas and request history — is stored on your own machine (a SQLite database; on macOS, for example, ~/Library/Application Support/jp.trimix.galleonql/galleonql.db). None of it is synced or sent to our servers.

The app never connects anywhere on its own — it does not even check for updates automatically. It talks to our servers only in the cases listed in the next section.

3. What we collect, and what we do not

What	When	Sent to	Why
License checks Your license key, a device activation ID and a fixed app name. No machine name or user name is sent	When you register a key, and on each launch while a key is stored	Our server (AWS, Tokyo region), which queries the payment provider Lemon Squeezy	To confirm the key is valid
Purchase records Email address, amount, product name, order number	Only when you buy	Sent by Lemon Squeezy to us	To confirm the purchase and provide support. We never receive your card number
Crash reports App version, OS family and CPU (e.g. `macos/aarch64`; no detailed OS version), time of occurrence, error message, location, stack trace, error category, and an anonymous device ID	Only if you turn it on in Settings, and then choose "Send" on a preview screen (off by default)	Our server (AWS, Tokyo region)	To find and fix defects
Usage analytics A fixed set of 12 predefined events (launch, schema import, query sent, environment created, and so on) with fixed properties such as version, OS family and outcome, plus an anonymous device ID	Only if you opt in (off by default; a separate consent from crash reporting)	PostHog (EU region)	To learn which features are used, and improve them

We do not collect:

Name, postal address or phone number (with no accounts, we never ask)
Your query text, endpoint URLs, headers or variable values. The analytics pipeline cannot carry them by construction — the set of fields is fixed
Card numbers (payment happens entirely on Lemon Squeezy's pages)

We do not link records across devices. Without accounts we have no way to do so.

4. The anonymous device ID

Crash reports and analytics carry a randomly generated ID (UUID) created on your device. It joins records from the same device and is not linked to your name or email address. Deleting the app's data folder generates a new ID.

5. Crash reporting in detail

Off by default. Even when on, nothing is sent automatically: on the next launch the app shows the full content to be sent (including the error message and stack trace), and sends it only if you choose "Send"
The fields are fixed, as listed above; there is no free-form comment box
Because error messages can contain URLs, tokens or the user name in home-directory paths, known patterns are masked automatically. This masking does not guarantee complete anonymisation — which is exactly why you get to review the full text before sending
Received reports are stored on our server (AWS, Tokyo region) and copied into our private issue tracker (GitHub) and internal notifications (Slack) for defect management. They are never published
See the crash reporting page of the manual for details

6. Usage analytics in detail

Off by default. On first launch the app asks whether you want to help; it measures only if you agree, and you can stop any time in Settings
Only 12 predefined event types (launch, schema import, query sent, environment created, purchase actions, and so on) with fixed properties can be sent; unknown fields are rejected by design. Query content, endpoints, headers and variable values cannot be sent
Data goes to PostHog ( privacy policy), EU region
See the analytics page of the manual for details

7. Payments and Lemon Squeezy

Payments for the paid plan are handled by Lemon Squeezy (privacy policy). The buy button opens Lemon Squeezy's checkout page in your default browser, and you enter payment details directly there. Neither the app nor we ever handle your card number.

The display name you register with Lemon Squeezy (or, if unset, your email address) is returned to the app to label the license holder, and is stored on your own machine.

8. The endpoints you connect to

The app sends requests to the GraphQL endpoints and OAuth2 token endpoints you configure, when you tell it to. What is sent there (queries, headers, credentials) is between you and that service; we never receive it. Its handling is governed by that service's own policies.

9. Data on your machine, and how to delete it

Your working data lives in the SQLite database above. Tokens placed in environment variables are stored as-is (unencrypted), so we recommend protecting the machine itself (disk encryption, login password)
Your license key and its display name are stored in the app's data. The validation cache stores only a hash of the key, never the key itself
Deleting the app's data folder (on macOS, for example, ~/Library/Application Support/jp.trimix.galleonql/; on Windows / Linux the OS's standard app-data location) removes all of it. Uninstalling alone may leave it behind

10. Sharing with third parties

Beyond AWS (server hosting), Lemon Squeezy (payments), PostHog (usage analytics, only if you opt in) and GitHub / Slack (private crash-report management) listed above, we share nothing. We do not sell data. Disclosure required by law is the only exception.

11. About the website

The official website (galleonql.com) uses Google Tag Manager for traffic analysis and loads external widgets for donations (Buy Me a Coffee, Ko-fi), each governed by its provider's policies. The page you are reading now (trimix.jp) loads no analytics scripts.

12. Retention

Crash reports are kept for as long as needed to investigate and fix defects
Purchase records are kept for as long as needed for support and legal obligations
Analytics data follows PostHog's retention rules
Data on your machine is under your control and can be deleted as described in section 9 at any time

13. Children's privacy

The app is a developer tool and is not designed for children under 13. We do not knowingly collect information from them.

14. Changes to this policy

If we change this policy we will update this page and its date. We will announce significant changes on the official website.

15. Contact

For questions about this policy or your data, write to .

Provider: trimix