Privacy
We collect your name, email and organization, because a license is issued to a person and an unreachable account is a license nobody can use. We collect nothing about your databases.
Who we are
SQL Multicast is operated by AERai Group LLC, the controller of the personal data described on this page. Contact us at support@sqlmulticast.com.
What the app never sends us
- Server, instance or database names
- Connection strings, usernames or passwords
- Script content, query text or results
- Schema, table or column names
- Anything from a run log
That is a property of the code rather than a promise layered over it. The only outbound calls the application makes are a license request carrying an access token, a random install identifier and the name of the computer (see Devices, below), and, in builds you download from us rather than from the Microsoft Store, an update check against a public GitHub repository. The Store updates its own installs, so those make no update check. There is no telemetry endpoint.
What we hold
Your name, email address, organization, and the answer you gave to the eligibility question - which is the record of what you declared. If you choose to add a password, it is held hashed and we cannot read it. A sign-in code is kept only as a hash, for ten minutes, and is deleted once used. The licenses we have issued you, so we can answer what has been signed and for whom. Payment records are held by our payment provider; card details never reach us.
The identifier in your license
Your license carries an opaque identifier derived from your account — a hash, not your email address. The desktop app uses it as a folder name. It is deliberately not your address: addresses change, and a folder named after one would write your email onto every machine you ever sign in from.
Devices
A license covers up to three devices per user. To enforce that, each time the desktop app asks for a license it sends a random identifier it generated on first sign-in and the name of the computer. We keep both, with when the device was first and last seen, for as long as your account exists or until you remove the device from your account page. A device that has not been seen for 30 days stops counting toward the three.
The identifier is random: it is not derived from your hardware, your network card or your operating system, and we collect no hardware details. The computer name is whatever you called the machine, so if that names you or your employer, it names you to us. Command-line use on build agents and air-gapped machines does not send either, and is not counted.
Release email
Optional, unticked by default, and never a condition of getting a license. Separate consent, because it is a separate purpose.
Your data on your machine
Workspaces, projects, scripts, connection details and run logs stay on your machine. Connection secrets are held by Windows DPAPI, scoped to your user account. Run logs record target and database names and SQL error text — your production topology — and are kept outside your workspace folder specifically so that committing a workspace to source control does not commit them too.
Your rights
Ask us for a copy of what we hold, a correction, or deletion, and we will do it. Get in touch.
The full policy
This page is a summary. The policy itself, with how long we keep each kind of data, why we are allowed to process it, where it is stored and how we tell you about changes, is on its own page.