Privacy Policy

VERSION 2026-10-27

This Privacy Policy explains how ProfWorkBench, LLC, a New York limited liability company ("ProfWorkBench," "we," "us," or "our"), handles information when you use this website (profworkbench.com), our secure contact desk, and the Overwrite, MetaWrite, MetaLume, HeaderLume, HashLume, pcapLume, QRLume, HexLume, HexWrite, ShotLume, TallyLume, WADL Builder and DEV (Digital Evidence Vault) applications (collectively, the "Software and Services").

Our approach is to collect as little as possible. Most of what follows describes what the Software does not send anywhere, and the outside services some features contact, so that you can decide for yourself.

1. Who This Policy Covers

ProfWorkBench, LLC is responsible for the information described here. This policy does not cover services operated by others that you use alongside the Software, such as the Apple App Store, iCloud, Apple Maps, Lemon Squeezy, Discord or the third-party lookup services named in section 2.C. Their own privacy policies apply to them, and the lookup and timestamp services an app contacts receive only the items named for that app in section 2.C. Our separate product websites, such as getoverwrite.com and qrlume.com, are not described by section 2.D, which covers profworkbench.com only.

2. Information We Collect

A. Information the Software sends us

The applications send no analytics, usage data, crash reports or device information to ProfWorkBench, and none of them requires an account. Only two requests reach servers we operate, both described in section 2.C: Overwrite Elite's update check (to getoverwrite.com, sending the app and macOS version), and the scan of a WADL label's QR code (to usewadl.org, sending the link the code carries).

• Device Information: We do not collect information about your device. Where an application needs details of your hardware, such as a drive's serial number for an Overwrite Certificate of Erasure, it reads them on your device, and they go no further than the records you export or sync yourself; none of it reaches ProfWorkBench, apart from the one-way hash identifying a Mac that Overwrite Elite's licence check gives Lemon Squeezy, which Lemon Squeezy shows us with that licence.
• Transaction Data: Purchases in the App Store applications are handled by Apple. Apps that offer purchases check your purchase status with Apple through StoreKit. WADL Builder, for example, has no purchases and does not use StoreKit. We do not collect, process, or store your credit card numbers, billing addresses, or bank details. Overwrite Elite licences are sold through Lemon Squeezy, which handles those payments.
• Reports from Apple: If you choose in your device's settings to share analytics or crash data with app developers, Apple may provide us with crash reports and aggregate usage statistics about our applications. These come from Apple under Apple's terms, not from our applications, and we use them only to fix problems.

B. Information you give us

• The secure contact desk: When you write to us through the secure contact desk, your name, email address and message are encrypted in your browser to our public PGP keys before anything is sent. Our relay, hosted on Cloudflare, receives that ciphertext together with the inquiry type you chose, a timestamp, and a Cloudflare Turnstile result used to block automated abuse; like any web request, it also sees your network address. The relay cannot read your message. It delivers the ciphertext to end-to-end encrypted mailboxes hosted by Proton, where only authorized ProfWorkBench personnel can decrypt it, and sends our team an ordinary email notification that a message has arrived, without the message itself.
• Programs and applications: Applications for our beta, classroom and discount programs arrive through the same desk. If you join a beta program, Apple's TestFlight shares with us the name and email address you use there, and any crash reports, usage data and feedback, including screenshots, that TestFlight sends us (please keep case data out of feedback screenshots), and the program's private Discord community is operated by Discord under its own terms and privacy policy.
• Overwrite Elite purchases: Overwrite Elite licences are sold through Lemon Squeezy, which acts as the seller and processes your payment. Lemon Squeezy shares with us the order details we need to issue and support your licence, such as your name, email address, licence key and order record. We never receive your card details.

C. Data processed on your device, and the services each app contacts

The core functionality of every application runs locally on your device. Where an application contacts an outside service, this section says which service, what it receives, and when.

• Overwrite: Wiping, and the hardware details written into the Certificate of Erasure, are processed entirely on your Mac. The App Store edition uses no third-party services; its only network traffic is Apple's StoreKit. Overwrite Elite (direct download) contacts Lemon Squeezy to activate and periodically re-check your licence, checks for updates through Sparkle (on by default), and, while certificate sealing is on (the default), sends a 32-byte hash, never a file, to OpenTimestamps. Neither edition sends usage data or analytics to anyone. Elite's licence check sends your licence key and a one-way hash identifying this Mac to Lemon Squeezy.
• MetaWrite: Metadata extraction, viewing and removal happen on your Mac, and we never receive your files, their metadata or their hashes. MetaWrite checks your purchase with Apple's App Store at each launch. A file that contains a location loads Apple Maps tiles to show it, and clicking the location opens Apple Maps; turning on Zero Telemetry turns off the map, but not the App Store check. In MetaWrite 1.0, previewing a web-type file, such as an HTML page, can load content that the file links to from the internet, whether Zero Telemetry is on or off.
• MetaLume: Photos are inspected and cleaned on your Mac and are never uploaded, and we never receive your photos, their metadata or the hash of a cleaned copy. MetaLume's only network traffic is Apple's StoreKit, which loads the Lifetime Unlock's details and checks your purchase each time the app starts. Clicking a photo's location opens Apple Maps, a separate Apple app, which then handles those coordinates under Apple's privacy policy; MetaLume does nothing with them until you click. There are no accounts, analytics or crash reporting.
• HeaderLume: Email message and header parsing is performed locally on your device; full email bodies and email addresses are never transmitted. By default (Zero Telemetry off), analyzing a message sends the relay hop IP addresses to ipwho.is and the sender's domain to rdap.org (which redirects to that domain's registry). If you provide your own VirusTotal API key, attachment SHA-256 hashes are queried for reputation. Turning on Zero Telemetry blocks all three lookups. While Zero Telemetry is on, macOS may still communicate with Apple's App Store for StoreKit license checks and fetch Apple Maps tile imagery for the routing map.
• HashLume: All checksum generation occurs locally on your device; files are opened read-only and never uploaded. No crash logs, usage data, file names or digests are sent to ProfWorkBench. The only network connection HashLume makes is with Apple's App Store via StoreKit, to show, buy, verify or restore the Sealed Certificate in-app purchase. There are no analytics, no accounts, and no advertising frameworks in the app.
• HexLume: HexLume has no network entitlement and makes no connections of its own; files are opened read-only. macOS services may still contact Apple on the system's behalf. There are no purchases, accounts or analytics, and no crash reporter of its own; if you allow it in macOS, Apple may share crash reports with developers.
• HexWrite: HexWrite has no network entitlement and can send nothing to us. Its only network traffic is Apple's StoreKit and certificate validation, made on the app's behalf. There are no accounts, analytics or crash reporters.
• QRLume: Scanning and analysis run entirely on your device. QRLume contains no third-party analytics or advertising SDKs and sends no analytics, crash logs or usage data to ProfWorkBench; ProfWorkBench never receives your scans. The only network traffic QRLume initiates goes to Apple. Apple’s StoreKit checks for a Forensic Pro purchase each time QRLume starts, and handles buying and restoring it; that traffic carries no scan data. While iCloud Sync is on, your evidence records, scanned payloads and images included, are copied to the private CloudKit database in your own iCloud account, encrypted in transit and at rest; end-to-end encryption requires Advanced Data Protection on your Apple Account. On a new install, iCloud Sync stays off until you turn it on.
• pcapLume: Packet capture files are parsed locally on your device; capture files are never uploaded. While Zero Telemetry is off, two lookups run without a click: with Pro, GeoJS receives the public addresses in Top Talkers; and if you have saved your own abuse.ch key, MalwareBazaar receives the SHA-256 of files carved from a capture. The rest run only when you ask: with Pro, Shodan and Censys look up an address you pick, using your own keys (or, if you choose, each packet you select for the rest of a session); the Test buttons in Settings check your saved keys with Shodan, Censys and abuse.ch; and AlienVault OTX (your own key), the abuse.ch feeds and the IEEE vendor list download when you press Sync. Turning on Zero Telemetry blocks every lookup pcapLume makes itself. Standard Apple StoreKit handles license verification, and external WHOIS links open in your browser outside the switch.
• DEV (Digital Evidence Vault): DEV hashes every exhibit on your device with Apple's CryptoKit (SHA-256, SHA-1 and MD5) and keeps your evidence, case records and custody log on your device. DEV has no account, no analytics, no ads and no crash reporting, and sends nothing to ProfWorkBench; we cannot see your evidence. DEV makes these network requests, and every one except the App Store can be switched off in the app's Settings:
  • Trusted timestamps (on by default): for each photo, video, audio recording or note captured in DEV, and each file imported in DEV, DEV sends the exhibit's SHA-256 digest, never the file, to the RFC 3161 Time Stamping Authority at freetsa.org, and a 32-byte digest to the OpenTimestamps calendars a.pool.opentimestamps.org, b.pool.opentimestamps.org and a.pool.eternitywall.com. Apple Watch recordings, files shared into DEV from other apps and evidence packages imported from another examiner are hashed and logged, but DEV requests no timestamps for them. The calendars later commit what they receive to the Bitcoin blockchain; DEV stores the proof it is given and does not itself upgrade or check that commitment.
  • Capture-time check (on by default): at each capture on iPhone, iPad or Mac, DEV asks time.apple.com for the time.
  • Network transcription (off by default): only if you switch on "Allow network transcription", Apple's speech service may receive the audio of a recording in order to transcribe it. Apart from iCloud sync and your device's own backups, this is the one path that sends evidence itself rather than a digest.
  • iCloud sync (off until you turn it on): your case records are copied to the private CloudKit database in your own iCloud account, and case folders created while sync is on are stored in the app's iCloud Drive container. Apple encrypts this data in transit and on its servers; DEV adds no encryption of its own. ProfWorkBench has no access to it.
  • App Store: Apple's StoreKit checks your purchase status when the app starts, and handles buying and restoring purchases.
  Like any internet request, these services see your device's network address. The app's Zero Telemetry switch turns off the timestamp services, the capture-time check and network transcription, and DEV's Siri, Shortcuts and Control Center capture actions; it does not change iCloud sync, which has its own switch. Each exhibit also records when it was made; facts about the device that made it (its model, its system name and version, the app's version and the app's identifier for that device); and, if you allow DEV to use your location, where your device was when you captured a photo, video, audio recording or note on iPhone, iPad or Mac (its coordinates, their accuracy and the time of the fix). These details are stored with the exhibit. They leave your device only inside the reports, watermarked copies and evidence packages you choose to export, in your own iCloud account if iCloud sync is on, and in your device's own backups. A watermarked copy prints the coordinates on the copy itself. Evidence files and case records are included in your device's backups, including iCloud Backup when that is on.
• ShotLume: ShotLume has zero network configurations of its own. No crash logs, usage data, or file metadata are ever transmitted to ProfWorkBench. Your captures go only where you send them: choose iCloud Drive, the default on a fresh install, and macOS syncs them between your own devices through your personal iCloud account, and ProfWorkBench never sees them; choose a folder on your Mac and they never leave it.
• TallyLume: Your counters and their history are stored on your device, and nothing is sent to ProfWorkBench; there is no account and no analytics. TallyLume syncs your data, including any GPS locations on your tallies, through your own iCloud account (on by default), and its map views load Apple Maps tiles.
• WADL Builder: WADL Builder makes no network connections and collects no data; its App Store privacy label is "Data Not Collected." A label's QR code carries the whole disclosure inside its link (the narrative, the tool list, the assignment title and the course name), so when someone scans it, that link is sent to usewadl.org to be read. That needs the internet, and Cloudflare, which hosts the site, may keep the link in its request logs. Text you copy may reach your other Apple devices through the clipboard, and links to profworkbench.com open in your browser.

D. This website

Our pages set no cookies, run no analytics and load no advertising or tracking code. The site is hosted on Cloudflare, whose servers process standard request information, such as your network address and browser type, to deliver pages and protect the site; these server logs are the minimum required to operate it, and the hosting provider keeps them for a limited period under its own retention policy. The contact form uses Cloudflare Turnstile, on that form only, to block automated abuse; Turnstile checks signals from your browser to tell people from automated programs, under Cloudflare's privacy policy. Links to the App Store and to our product sites take you to services with their own policies.

3. How We Use Information

We use the limited information described above to answer your messages, run our programs, issue and support licences, fix problems in the Software, protect our services from abuse, and meet our legal obligations. Where data protection law requires a legal basis, we rely on performing our agreement with you (support and licences), our legitimate interests in operating and securing our services, and compliance with law. We do not use information for advertising, and we do not build profiles of you.

4. How We Share Information

We do not sell, rent, or trade your personal information, and we do not share it for targeted advertising. We share it only with service providers that help us operate (such as Cloudflare for hosting and the contact relay, Proton for encrypted mail, Apple for the App Store and TestFlight, and Lemon Squeezy for Overwrite Elite), when the law requires it, to protect our rights or the safety of others, or as part of a merger, acquisition or sale of assets, in which case this policy continues to apply to the information transferred.

5. Where Information Is Processed

ProfWorkBench is based in the United States. Information you send us may be processed in the United States, in Switzerland (where Proton operates), and in other countries where our service providers operate, which may have data protection laws different from those of your country.

6. How Long We Keep It

We keep messages and program applications for as long as we need them to answer you, to run the program you applied to, and to keep a record of the request, and we delete them when they are no longer needed for those purposes or to meet a legal obligation. Licence and order records are kept for as long as the licence is active and as required for tax and accounting purposes.

7. Your Choices and Rights

Depending on where you live, you may have the right to ask us for a copy of the personal information we hold about you, to correct or delete it, to restrict or object to its use, and to receive it in a portable form. To make a request, write to us through the secure contact desk; we may need to confirm your identity before acting on it, and we will not treat you differently for making one. You can stop an app's optional outside connections at any time with its Zero Telemetry switch or the setting named on its page, and delete synced data from your own iCloud account. If you are in the European Economic Area, the United Kingdom or Switzerland, you may also complain to your local data protection authority. We do not sell or share personal information as those terms are defined in California law.

8. Children

The Software and Services are not directed to children under 13 (or the higher age set by the law of your country), and we do not knowingly collect personal information from them. If you believe a child has sent us personal information, contact us through the secure contact desk and we will delete it.

9. Security

We take reasonable precautions to protect your information, including encrypting desk messages in your browser before they leave it, though no method of transmission or storage is completely secure and no absolute security can be guaranteed.

10. Changes to This Policy

The version shown at the top of this page is the date the current text took effect. When we change this policy in a way you need to know about, we publish the new text with a new version date, and an application may ask you to agree to the current version. Corrections that do not change its meaning keep the version and are noted as an edit.

11. Contact Us

If you have any questions, please write to us through the secure contact desk. ProfWorkBench, LLC (New York, NY)

Companion documents: our Terms of Use, and the plain-language summary on the standards page.