Privacy
No Spiral app makes an account, sends analytics, or runs after you close the window. Nothing leaves your computer for processing unless you choose that path yourself. Where an app talks to the internet, it names the host and talks to nothing else.
Wallpaper
Reaches Wallhaven's public SFW API when you search or apply. On launch it calls license_ensure against the spiral-license worker. On open it may ask GitHub once whether a newer build exists — named in Settings, and switchable off. It validates an image before writing or applying it, and keeps thumbnails on disk behind a cap you can see in Settings. Closing the window quits.
Slim
Writes browser enterprise policy files on this machine and shows each change first. On launch the shipped app calls license_ensure against the spiral-license worker. On Windows and Linux it runs from the scripts in the repository — there is no shipped Windows installer.
Clean
Removals go to Trash. Nothing is scanned off-device. On launch it calls license_ensure against the spiral-license worker. There is no update check and no updater in the builds that exist today.
Resume
The free pass never opens a connection. A model runs only if you add your own API key or download one to disk, and the app names which engine did the work. Remote keys talk to the host you chose — Anthropic, OpenAI, or a custom base URL you set. Offline models are fetched from Hugging Face when you press Download. Titles, employers, dates, schools and numbers are extracted before a model sees anything and checked afterwards. A fact that moves is discarded.
License check
Shipped desktop apps validate your Whop license key on launch through Spiral's validator at spiral-license.cohencool.workers.dev. That server calls Whop's API with a company key so the apps never ship one. The request sends your license key, a machine identifier, and which app you opened — nothing else. If the validator is unreachable, apps allow up to 72 hours offline before asking again.
This site
spiralcc.tech is a static site. Fonts and images are served from the same host. The site loads Whop's page pixel (`t.whop.tw`) so purchase ads can attribute visits; that is site analytics for ads, not app telemetry.
Questions: cohenbcoolidge@gmail.com