Your data is not the product.

Privacy policy · Effective October 20, 2026 · Tom Hardy

I value my privacy. I value yours just as much.

I, Tom Hardy, and everyone who helps build or shape AirWitness and the FOX family of tools commit to never selling, renting, trading or otherwise profiting from your personal data. I build tools to help you do your job. I don’t need a copy of your working life to do that.

This policy covers my AirWitness and FOX tools and the websites, accounts, licensing, downloads, beta program and support services I operate for them.

What stays with you

Your network investigations, packet captures, terminal sessions, project files and ordinary work belong with you. Choosing to upload evidence to an Evidence Room transfers a copy to the Engineer handling your customer’s issue, as explained below. Installation and license reporting is not a feed of the networks you visit, the commands you run, your packet traffic, or your physical location.

When you ask a tool to run a network test, contact a device or use an external service, that connection still goes to the destination you selected or the test’s configured service. This promise does not make those connections invisible to that destination.

Evidence Rooms

This section applies when you choose to use Evidence Rooms.

Our commitment to privacy

AirWitness and its staff are committed to personal privacy. Your data is never the product. Our purpose is to make troubleshooting easier and help Engineers work with their customers, not to mine evidence for unrelated purposes, build advertising profiles, or sell, rent or trade your information. Uploading evidence does not give us permission to use it for marketing.

We access evidence only as needed to provide and protect the Evidence Rooms service, resolve service problems, investigate abuse, or meet applicable legal obligations. These commitments apply to AirWitness and its staff. The receiving Engineer's handling of evidence in their own systems is described separately below.

A transfer service for Engineers working with their customers

AirWitness supplies diagnostic software and Evidence Rooms so Engineers can collect evidence from Field staff and work with their own customers. Providing the software or hosting an Evidence Room does not itself mean AirWitness is investigating the customer's network or providing engineering support. The Engineer and their organization handle the investigation and customer relationship. If the same people also provide engineering services, that is a separate role from operating AirWitness.

AirWitness and AirWitness Snapshot collect network measurements to help investigate connectivity problems. Evidence packs may include network names, access-point identifiers, IP addresses, connection measurements, test results, timestamps, ticket and site references, and notes you enter. Where supported and explicitly enabled, they may include a client MAC address or device name. Troubleshooting evidence can contain personal, customer, confidential or security-sensitive information. Do not assume it is anonymous or free of information belonging to other people or organizations.

Creating a local capture does not upload it to an Evidence Room. Uploading is an explicit action. By uploading, you instruct us to store and make that evidence available to the room's licensed Engineer and their authorized peers. Service administrators may inspect evidence where needed to operate or troubleshoot the Evidence Rooms service, address security issues, or investigate abuse. The room is associated with its owner's license. The service also keeps operational room, transfer and administrative records. The contribution code alone does not grant access to browse or download other submissions.

Evidence Rooms are designed to transfer evidence to the Engineer handling the customer's issue. Engineers are expected to download evidence promptly and use it in their own troubleshooting workflow, including ticketing and customer support systems. Multiple engineers may review it, and the Engineer may share relevant evidence with their authorized colleagues, customer, service provider, or equipment vendor as part of the investigation. These recipients and systems are outside the Evidence Rooms service. Their access controls, privacy notices and retention rules may differ from AirWitness's. You are responsible for having authority to submit and share the evidence. Review the pack and remove information you are not authorized to disclose before uploading.

Room retention and copies held elsewhere

Open rooms have a displayed expiration. Expiration closes a room unless it has been extended or made persistent by an administrator. Closing stops new uploads; authorized downloads remain available until cleanup. Closed-room cleanup normally occurs 30 days after closure, but administrators may shorten or extend retention or delete a room sooner for storage, security, abuse or operational reasons. Closed rooms are temporary recovery storage, not an archive or a guarantee of availability. Persistent rooms remain until closed, deleted or their retention status is changed; closing starts the normal cleanup process.

Deleting a room removes the evidence held by the Evidence Rooms service, including temporary uploads and derived previews. Evidence files are excluded from AirWitness application and deployment backups. Limited operational and administrative records may remain under the main privacy policy.

Room closure, expiry, cleanup or deletion does not delete local originals, files already downloaded by recipients, or copies entered into ticketing systems. Those copies remain subject to the organizations and policies responsible for them. Contact the receiving Engineer or organization about their handling of those copies. Our commitments continue to apply to information we hold.

The beta’s small phone-home

Private beta access is permission to test a build, not permission to install it on dozens of devices. Limited installation and license records help me administer that access and spot installs beyond what we agreed. I think that is a fair trade, and I want it stated plainly.

Depending on the product and build, those records can include a locally generated installation ID, license identity, product and version, installation or license-import timestamps, and—for activation-based builds—the computer name and first/last license check-in times. A reinstall that clears local state can create a new installation ID. Newer import-reporting builds queue an import event while offline and send it when a connection is available.

These are installation and licensing records, not a record of your day-to-day work. They are not GPS or a map of where you use the tool. As with any online request, the network address used to contact the service can appear in ordinary server logs.

A valid supported license file can still be loaded offline. Reporting does not turn that offline import into a requirement to contact me first. Available beta access, platform permissions and any agreed installation limits still apply.

Optional wireless hardware profiles

When your build includes Hardware profile, collection happens locally and you can review the complete details before choosing Send profile. The profile contains the app/OS version, architecture, wireless adapter model and available driver, firmware, radio or band information. It contains no account, license or installation ID, computer/user name, serial number, network name, MAC/IP address or location.

The service groups matching configurations and records submission counts and first/last receipt times to help with compatibility work. Counts are reports, not unique people or devices; a report does not certify compatibility. Profiles are available to authorized staff, not automatically published. Nothing is queued for automatic sending if a submission fails. Normal service access logs may still contain the connection’s IP address, and an unusual hardware configuration can be distinctive.

Accounts, applications and downloads

If you create an account, apply for testing or receive a license, I keep the information needed to manage that relationship: for example, your name, email, application answers, permissions, agreement acceptance and license details. Passwords are stored as password hashes, not readable passwords.

The download service records which product and version was delivered and when. Where available, the record is associated with the signed-in account or the license link used. That helps me understand which builds are reaching testers; a download count does not tell me what you did with the software or prove who used a shared link.

If you send a website question or email, I receive the contact details and message you choose to provide so I can answer.

Crash reports and information you choose to share

Crash reports are optional. A crash may save a report on your device, but you decide whether to share it. The reporting service rejects automatic uploads from earlier builds. In updated builds, you can review and edit the complete report, remove sensitive details, and explicitly send that one report, keep it locally, or delete it without sending. Failed attempts remain local and require another explicit send; they are not retried automatically.

A report can contain the error message and stack trace, application and operating-system versions, timestamps and report identifiers. Error messages and paths can contain personal or customer information. Automatic redaction may miss it: review and scrub the report before sending. Screenshots are not automatically captured by this crash-reporting mechanism. The reviewed-report flow does not attach your license proof or account identity; ordinary server logs can still contain the network address used to send it.

Reports you choose to send become posts on the beta feedback board, visible to approved participating testers and staff. Messages, screenshots and attachments you post there are visible to that audience too. The board is access-controlled, not a public webpage. Closing the review window does not send anything. Older installed builds may still attempt an upload, but the service refuses those unreviewed reports. Already-submitted reports are not automatically removed by this change; contact me about deleting sensitive material.

If you choose to send screenshots, logs, a show tech, configuration details or hardware information for troubleshooting, I use them to reproduce problems, fix bugs, understand what does not fit your workflow and improve the product. Please sanitize them first: remove passwords, keys, tokens, customer details and anything you are not authorized to share. If something is sensitive, contact me directly instead of putting it on the board.

What I use the information for

Only to operate and protect these services, administer accounts and beta access, deliver licenses and builds, answer you, and make the tools better. Limited installation and download records help show which products and builds are being tried. Error reports and information you choose to share help explain how they can be improved.

I do not sell your information to advertisers or data brokers, build advertising profiles from it, or give it away for someone else’s unrelated use. Access by people helping me is limited to the work they need to do under this same privacy commitment.

Who may handle it

Running a website and answering an email involve hosting and email providers. They may handle the information needed to deliver those services. That necessary handling is different from selling or giving your data away for their own use. Beta-board visibility is explained above; choose what you share there accordingly.

I will not publish your private support materials or use them for marketing without your permission. If disclosure is legally required, I may have to provide information I actually hold. This policy cannot promise that no lawful demand will ever arrive. My separately dated warrant canary states what I have personally confirmed as of its stated date.

Snapshot’s connectivity check

Snapshot checks your connection by requesting check.airwitness.net/generate_204, which returns an empty response. Like any web request, it shows the server your network address for that moment, but these requests are not logged or kept. No capture evidence is ever sent to it.

Websites and cookies

The public product and documentation pages do not use advertising trackers. Account services use cookies needed for sign-in, session security and form protection. Web services can retain ordinary access and security logs, including an IP address, requested address, time and browser information, to deliver the service and investigate faults or abuse. Those logs are not a record of what you do inside the desktop tools.

Links to other companies’ websites take you to their services and their own privacy policies.

Keeping information and asking for help

I keep information for the account, license, support, security or legal purpose it serves. There is currently no single automatic deletion deadline covering every record. Backups may retain older copies until they rotate out. Evidence Room files are excluded from our application and deployment backups; their separate closure and cleanup rules are explained above.

You can email me at admin@airwitness.net to ask what information I hold about you, correct it, request deletion, or discuss a private way to troubleshoot. I may need to verify that it is yours. I will explain if a record must be kept for an active license, security or legal obligation, or if a backup copy cannot be removed immediately.

If our collection or purposes change, this page will be updated with a new effective date. I will not quietly turn information entrusted for support into a product for someone else.

Your trust matters more than another data point. If something about a tool’s behavior or this policy does not sit right with you, let’s talk.