Privacy Policy

Beckham Enterprises, LLC ("we", "us") is a one-person software company in Vacaville, California. This page describes what our programs and this website collect, why, and who else gets to see it. It is written to be read, not to be survived.

In short

• Your work stays on your computer. Labels, designs, images, spreadsheets you merge from — none of it is uploaded anywhere. LabelVault has no cloud account and no sync. Maintenance Machine's check results, drive readings, problem history and support reports stay on your PC, unless you choose to send a report with a feedback message. (KeysWalletWatch's optional sync uploads only end-to-end encrypted vaults; see its own policy.)
• LabelVault sends nothing except licence checks. Maintenance Machine sends licence checks and update checks and, when you press Send, Help & feedback messages, and its network checks contact the test servers described below. None of our programs has analytics, telemetry or crash reporting built in.
• We never see your card. Payments go through Stripe.
• We do not sell or share personal information, and we do not use it for advertising.
• ScamEscape sends nothing about the computer or what is on its screen. Its optional family alerts keep the names, phone numbers and email addresses the family adds, only to send those alerts — details below.

What the programs send, and when

A program contacts our licence service at licenses.beckhamenterprises.com only when it has a reason to: you start a free trial, you enter a licence key, you sign out, or the program re-checks a licence it already has (roughly once a day while it is open). For LabelVault, nothing else goes out, and nothing goes out at all before you start a trial or activate. KeysWalletWatch also checks keyswalletwatch.com for updates and, only if you use them, talks to its sync relay and Have I Been Pwned. Its policy describes exactly what each one sends.

Maintenance Machine also contacts these, and nothing else:

• Update checks — about a minute after it opens, once a day while it stays open, and when you click Check for updates, it downloads the list of releases from downloads.beckhamenterprises.com. The request carries the app version and your type of Windows (for example 64-bit), nothing about you. If there is an update, it downloads it from the same place.
• Network checks — only when you run one, or Check my PC. Your PC pings your own router (and a network printer, when the printer check knows its address), looks up and loads Microsoft's connectivity test page (www.msftconnecttest.com, the one Windows uses for its own network icon, or www.msftncsi.com if that is blocked), and, only if your own DNS fails, asks the public DNS servers of Cloudflare (1.1.1.1) or Google (8.8.8.8). It also sends one DNS query to a reserved test address where nothing answers, to tell whether your network intercepts DNS. None of these go to us, and nothing about the results is sent anywhere.
• Windows repair — its DISM step lets Windows itself download repair files from Microsoft's Windows Update servers.

Maintenance Machine keeps its logs (one file a day, the last 14), its licence file, your last check results and its repair history on your PC in C:\ProgramData\MaintenanceMachine, and records the changes it makes in Windows' own Application event log. The support report is only ever saved to a file you choose, copied to your clipboard, or sent with a Help & feedback message when you tick its box (see below); the program never uploads it otherwise.

Help & feedback sends something only when you press Send: your message, your email address if you give one (so we can reply), and the app and Windows versions. The PC report goes too only if its box is ticked (it starts ticked for “Report a problem”, and you can see exactly what is in it before sending). Your computer’s name, your Windows user name and hardware serial numbers are included only if you tick that separate box, which starts off. It reaches us as an email (through Resend) and is also saved in the support inbox on our licence server so we can follow up; it stays there until we delete it. Our server also keeps an anonymous counter that limits each connection to twenty messages an hour.

When it does, it sends:

• Your email address, if you are starting a trial or we already have it from a purchase. It is how we mail you your key and how you get it back if you lose it.
• A machine id. This is a one-way hash — sha256 of the product name plus your Windows installation id. The underlying Windows id never leaves your computer, and the hash cannot be turned back into it. We use it to count the computers a licence is on and to stop one computer taking an unlimited number of free trials. The same computer produces unrelated hashes for different products of ours, so the two cannot be linked.
• A machine label — your computer's name, e.g. SHOP-PC, so you can tell your machines apart in the licence portal when you want to free up a seat. We do not store your Windows user name: older versions of our programs sent it alongside the computer name, and the licence service discards it.
• The program version and your Windows version, so we can tell whether your licence covers that build and so support questions can be answered.

Our server also records a hashed IP address against licence events. It is hashed together with the date, so it changes every day and cannot be used to follow anyone over time; it exists to rate-limit abuse of the free-trial endpoint.

We do not collect the names of your label files, what is on your labels, what you print, which printers you own, or anything about how you use the program. For Maintenance Machine, we do not collect the files it finds or cleans, your drive readings, your problem history or your system details.

ScamEscape family alerts (texts, calls and email)

ScamEscape is free and has no account, analytics or telemetry. If the family member who sets it up turns on family alerts, our alert service keeps, for that computer:

• the computer's nickname (for example "Mom's laptop") and a random device id, with a one-way hash of the device's secret token;
• for each person added: their name, phone number or email address, whether they get texts, calls or both, whether they have confirmed with their code, and whether they replied STOP;
• a short log of recent alerts and confirmation codes, kept for at most two days, to stop repeats and limit abuse. It records the alert type, the name of a remote-control program if one was involved, and the network address the request came from (to limit abuse), never anything from the screen.

The computer itself sends only the alert type, the time, the nickname and, where relevant, the name of a known remote-control program (such as "AnyDesk"). It never sends web addresses, screen contents, files, passwords or anything typed.

Mobile information: phone numbers and text-message consent are used only to send ScamEscape alerts and confirmation codes. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text-messaging originator opt-in data and consent will not be shared with any third parties, except the providers that deliver the messages for us (listed below), and only for that purpose.

A person's details stay until they are removed in ScamEscape's Family settings, or until you ask us to delete them, which we do within 30 days. Replying STOP to a text stops further texts at once.

What we keep, and for how long

Our licence database holds your email address, the licences issued to it, which machines they are activated on (as the hashes and labels above), and a log of licence events — issued, activated, deactivated, revoked and so on. We keep it for as long as you have a licence with us, because a perpetual licence has to be re-activatable years later, and afterwards as long as we need it for tax and accounting records.

Free-trial records are kept too, including after the trial ends. That is deliberate: it is what stops the same computer taking a new trial every month.

Help & feedback messages you send from Maintenance Machine, with any report you attached, are kept in our support inbox until we delete them. If you want yours removed, ask and we will delete it.

Who else sees it

We use a small number of services, and only for the job named:

• Stripe — payments. You enter your card on Stripe's own checkout page; we never see or store card numbers. Stripe sends us your email address, what you bought, and a customer reference.
• Resend — the emails that carry your licence key and receipts, the Maintenance Machine feedback messages you choose to send us, and ScamEscape alert and confirmation emails.
• Twilio — ScamEscape alert texts and phone calls, and the one-time codes that confirm a phone number. Twilio receives the phone number and the message, and nothing else.
• Have I Been Pwned — KeysWalletWatch only, and only when you run a breach check. It receives the first 5 characters of each password's SHA-1 hash, never the password or the full hash.
• Cloudflare — hosting for this website, the licence service and the download files.
• Microsoft — if you install a program from the Microsoft Store, Microsoft handles that download and tells us nothing about you beyond anonymous install counts. Maintenance Machine's network check loads Microsoft's connectivity test page, and Windows repair may download repair files from Windows Update; those requests go from your PC straight to Microsoft, as they would from Windows itself.
• Cloudflare and Google public DNS — Maintenance Machine's network check asks 1.1.1.1 or 8.8.8.8 to look up one test name, only when your own DNS fails.

That is the whole list. We do not sell personal information, we do not share it with advertisers, and nobody buys access to our customer list.

This website

The site sets no cookies of its own and has no advertising or cross-site trackers. We use Cloudflare Web Analytics, which is cookieless and reports page counts and referrers in aggregate; it does not build a profile of you or follow you to other sites.

The how-to guides play their videos from our own storage, in your browser's built-in player. No third party is involved and nothing is reported to anyone when you watch one.

Two pages — the LabelVault product page and its video page — embed a YouTube player instead, through youtube-nocookie.com, so YouTube sets nothing until you actually press play. Once you do, YouTube is handling that playback under Google's privacy policy, and we have no control over or visibility into it.

If you send us a message through the contact form, we get your email address and what you wrote, and we use it to reply to you.

Children

These are tools for work. They are not directed at children, and we do not knowingly collect anything from anyone under 13.

Your choices

You can ask us what we hold about you, ask for it to be corrected, or ask us to delete it — just ask, and we will do it within 30 days. Deleting your record means any licence attached to it stops working and cannot be restored, so we will say so before we do it. If you are in California, the EEA or the UK, the rights your law gives you apply here regardless of where we are; we do not charge you for exercising them and we will not treat you differently for it.

You can stop LabelVault contacting us entirely by signing out of your licence, but then it will stop printing, since that is what the licence check is for. KeysWalletWatch without a licence still opens your vault, read-only, and it still asks keyswalletwatch.com whether a newer version exists, once each time you start it and unlock your vault. That request carries only your IP address and the app version, nothing from your vault. Its sync and breach check only ever run if you turn them on.

Security

Traffic to our services is encrypted in transit. Licence keys are stored hashed, with an encrypted copy so support can re-send you the key you already paid for. We hold no card numbers and no account passwords, because we do not have accounts in the usual sense — a licence key is the only credential. If you turn on KeysWalletWatch sync, our relay stores copies of your vault, but only as they leave your PC: already encrypted, with keys that never leave your devices. We cannot open them, and neither could anyone who got into our servers.

Changes

If this policy changes in a way that matters, we will update the date at the top and, for anything significant, say so on the product page. We will not quietly start collecting something this page says we do not.

Contact

Beckham Enterprises, LLC, Vacaville, California, USA — contact us. See also our Terms of Sale and Software License.