Privacy Policy

The company behind Tempered is Tempered Software LLC, a Texas limited liability company that does business as Tempered, owned and run by Ian Jackson. It decides what personal data the app and this website collect and why, which under the EU and UK GDPR makes it the data controller for the data described here.

When you run an AI scan or ask the advisor a question, Tempered sends a compact telemetry snapshot to the Tempered advisor service so Claude can analyze it. You can preview the exact snapshot before it ever leaves your PC, on the Scans and Ask screens ("See exactly what gets sent"). That preview shows the base snapshot. The scan-specific extras listed below are gathered when that scan runs, so the preview does not show them. The snapshot contains only:

• Hardware specs — CPU model, core count, total RAM, GPU model, Windows version.
• Live metric numbers — CPU/RAM/GPU load, CPU and GPU temperature (with the name of the sensor source), network throughput, size and free space per drive letter, uptime.
• The names of running processes and startup entries, with their resource usage.
• For the Security & malware scan only: Windows Defender's protection status and threat names (never file paths), plus Tempered's own audit signals — whether each startup program and visible process is digitally signed, its signer's name (e.g. "Microsoft Corporation"), its install-location category (Windows, Program Files, AppData, Temp…), and system posture facts like firewall and UAC state. Full file paths never leave your PC.

One more case, on Torque and Torque Max: a question or scan started inside Task Manager (Tempered) also carries a digest of what that window shows. That is the page you are on and any search filter, process names with their PIDs and usage, whether each one runs as you, as one of Windows' own service accounts, or as some other account on this PC, per-disk and per-adapter activity, service counts, the latest Process Watch names, and the top of App history. That ownership is only ever one of those three categories, or nothing at all where Windows will not say who owns a process. No account names, no paths, no command lines.

The snapshot never includes:

• The contents of any file, document, message, or email.
• Your name, email, browsing history, keystrokes, or screen contents.
• File paths or command lines. Startup entries are sent by name, never by their command.

The advisor service is a server we operate that holds the AI provider key so you never need your own. The snapshot is used to generate your findings and is not used to train any model. In Ask, Claude may also run a web search to identify a program. The search text is written by the model and can include a process name from your snapshot. Because using the app requires signing in, each request to the advisor service is authenticated with your account's verified sign-in token so we can look up your plan and enforce its quotas. Against your account email we keep usage counts and a daily estimate of what your AI use cost us (both expire within 40 days), plus the dates we first and last saw the account. The token is never added to the telemetry snapshot itself.

Each scan and Ask request also carries the app's version number (for example 0.5.9), sent next to the snapshot rather than inside it. We keep the most recent version we have seen against your account, with the date we saw it, and nothing else: it is how we can tell whether anyone is stuck on an old release instead of guessing. It is one short version string, the same one everyone running that build sends. It identifies no device and no installation, it is not an extra identifier of any kind, and it replaces nothing else described here.

One more small signal, on the free plan only in practice: when you open the Torque sheet for a locked feature, the app tells our server which feature it was. We keep that as a daily total per feature, not per person, so we can see which locked features people actually reach for. It carries no snapshot and no message text.

In Settings, off by default and only available on Torque and Torque Max, is "Let the advisor run commands." Turning it on lets the Ask advisor propose a single read-only PowerShell command when the telemetry snapshot alone can't answer your question — checking a specific service's status, a registry value, a version number. It cannot install, delete, change settings, or stop/start anything; Tempered refuses anything that looks like it would change your PC rather than just check it. You always see the exact command text in the chat and must approve it yourself before it runs — the same approval step every other advisor action uses, plus a warning you must click through each time you turn the setting on. If you leave this off, or you're on the free plan, the advisor has no such capability at all and will tell you so if you ask it to check something that needs one. When a command runs, its text and output are sent to the advisor service as part of that one conversation turn, and a record of the command (not its output) is kept in your local Undo Center for transparency. Turning this on does not change anything else this policy describes.

A separate Torque/Torque Max setting, "Let the advisor batch-apply fixes," also off by default, lets the advisor propose several reversible fixes in one turn instead of one at a time when you ask it to optimize everything — you still review and approve every single one, just together on one screen instead of a back-and-forth. It sends nothing extra beyond what a normal Ask conversation already sends.

A third Torque/Torque Max setting, "Let the advisor read diagnostic tool data," also off by default, lets the advisor read results back from Windows' own tools: Reliability Monitor's stability index and latest records (which can name a program that crashed), Event Viewer's crash history, hardware error and GPU driver details. It is read-only, every read needs your approval, and what it returns is sent to the advisor service as part of that one conversation turn. Each read is logged in your local Undo Center.

The Feedback screen lets you send a support request, feature request, or bug report straight from the app. A submission includes the category you picked, your message, the app version, and — only if you check the box on a bug report — a diagnostic snapshot (the same specs and process names described above, never file contents). If you are signed in, your account email is attached so we can reply; it is never guessed or pulled from anywhere else. A human reads every submission — nothing here is auto-answered or used to train any model.

Everything else. The change log, settings, metrics history, and the run history shown on the Scans and Junk Cleaning screens live in a local database on your machine (under %APPDATA%/Tempered). Tempered makes no change without your consent, and every change is recorded locally. Reversible ones can be undone from the Undo Center. If you never run an AI scan, use Ask, or attach a snapshot to a bug report, no snapshot of your PC is sent. The app still signs you in through Firebase, checks your plan with our server, and checks our download host for updates.

On Torque and Torque Max, the optional Process Watch monitor works the same way: once you turn it on, it records processes and services the first time it sees them appear (first/last seen, lifetime, peak RAM/CPU) in that same local database, capped at 500 entries. Those sightings stay on your PC unless you ask the AI about them. "Analyze with AI" and "Research with AI" send the recorded names with their times and peak usage, and Ask or a scan inside Task Manager carries the latest recorded names.

The optional Developer Hub (Torque) runs a strictly read-only local server so AI tools on the same PC can read Tempered's measurements. It is off by default, listens only on your own machine (127.0.0.1 — it is never reachable from the network), requires an access token shown only inside the app, and its 100 most recent calls are listed on the Developer Hub screen. It sends nothing to us or anyone else. What the AI tool you connect does with what it reads is up to that tool.

• Waitlist email. If you join the waitlist, we store your email address, the time, and your browser's user-agent string, to send the one note you asked for. It is kept in our own storage (Cloudflare KV), never sold or shared, and you can ask us to delete it at any time.
• Welcome email and review invitation. The first time you sign into the app, we send one welcome email to the address you signed in with, and we share that address once with Trustpilot so they can send you a single, independent invitation to review Tempered. That is the only thing Trustpilot receives, their use of it is governed by their own privacy policy, and the invitation never repeats. Reviews are never filtered on our side — we invite every user the same way.
• Download email (optional). If you ask us to email you the download link, or leave an address after downloading, we store it to send that link and at most two short check-ins: one asking whether the install worked, one pointing at where to start, with a link to pricing. Signing into the app cancels those check-ins, every one carries a one-click unsubscribe, and the address is never sold or shared. Leaving it is entirely optional — the download itself never asks for an email.
• Blog posts by email (optional). If you turn on "New blog posts by email" in the app's Settings, or sign up on this site and confirm the address, we store that address to send at most one email a week, and only when there is something new on the Tempered blog. Every one has a one-click unsubscribe, the address is never sold or shared, and it is off unless you turn it on.
• Torque trial records. If you start a Torque free trial in the app, three things are kept. We send two emails: a confirmation when the trial starts, and on day 4 one reminder that the trial is about to convert, with a cancel link that asks for one confirming click. Both are required service notices about a pending charge, so they are sent even to addresses that have unsubscribed from our other mail. A hashed, salted record that your address has used its one trial is kept permanently; it exists only to enforce one trial per person. The hash cannot be reversed, but the record also notes which Stripe subscription it belongs to. And a consent record (your email, that the trial terms were accepted, which version of the text, your language and time zone, and when) is kept for at least three years so we can answer a payment dispute.
• Contact messages. Mail to [email protected] gets a first reply drafted by Claude (Anthropic), which reads your address, subject and message to write it, and a copy goes to a person. If you email support or use the contact form, we keep your message and address to respond and to improve the product. The contact form also stores the name and topic you enter and your browser's user-agent string.
• Site assistant. The chat box on this site sends what you type to our server, which passes it to Claude (Anthropic) to write the answer. Our server does not keep the conversation. It stays in your browser tab until you close it. To cap abuse we keep a daily count against your IP address for about a day.
• Site analytics (HeyCatch). This website uses HeyCatch, a product-analytics service built on PostHog, to see how visitors use it: pages viewed, clicks, the referring site and campaign tags in the link, and recordings of page sessions (scrolling, clicks and page changes) that we watch to find the confusing parts of the site. It keeps a random identifier in a cookie and in your browser's local storage so one visit's pages can be grouped, and like any site you load, HeyCatch receives your IP address and browser details. It also receives a few named events from this site, such as "download started" or "newsletter signup", which never include your email address. One exception: when you start a paid subscription directly (not a free trial), our payment system tells HeyCatch that a subscription started, with your email address and plan, so we can see which parts of the site lead to paid plans. A free trial reports only that it started or converted, with the plan and Stripe's customer ID, never your email. The desktop app itself does not use HeyCatch. It is not used for advertising and is never sold, and blocking it with a content blocker does not break anything here.
• Download clicks. When you click a download button, we record that a download started, with the time, the referring site, any campaign tags in the link (such as utm_source), and the country Cloudflare reports for the request. No name, email or IP address is stored with it. It tells us which channels bring people who actually download.
• Uninstall page (optional). When you uninstall Tempered, its uninstaller opens one short page on this site asking why you are removing it. This happens only on a real uninstall, never when the app updates itself, and the version you were running is the only thing carried in the link. No answer reaches us unless you press submit: close the tab and none is sent. Opening the page is still a visit to this website, so the Cloudflare request logging described below covers it; the page itself carries no analytics script, unlike the rest of the site. If you do submit, we store the reason you picked, anything you typed in the optional detail box, that version, the time, and your browser's user-agent string. There is no email, account or machine identifier in it, which also means we cannot reply to it or tie it to you. We read it to find out what we got wrong.

The site is hosted on Cloudflare, which processes standard request logs (such as IP address) to serve and protect the site. The download-link and newsletter forms keep a count against your IP address for up to two hours, so they cannot be used to flood someone with mail, and the uninstall page keeps the same kind of count, for the same two hours, so one script cannot fill it with answers. Each of those counts sits on its own and is never attached to what you submitted or joined back to it afterwards. Fonts load from Google Fonts and the analytics script from esm.sh, so those hosts see your IP address too. Apart from the HeyCatch analytics described above, we run no advertising and no other third-party tracking.

Using the app requires signing in (email/password or Google), handled by Firebase Authentication. Paid plans (Torque and Torque Max) are processed by Stripe — Tempered never sees or stores your card details. Stripe Checkout does not require signing in first; it collects your email directly, and your plan is matched to your account by that email once you do sign in. Managing or cancelling a subscription happens through Stripe's own Customer Portal.

• Use Tempered without running an AI scan, using Ask, or attaching a snapshot to a bug report. Then no snapshot of your PC is sent.
• Ask us to delete your waitlist email or contact history.
• Uninstalling removes the program but leaves your local data. Delete the %APPDATA%/Tempered folder to remove it.
• Skip the uninstall question. It opens in your browser when you uninstall, and closing the tab sends no answer.

Questions about your data? Email [email protected], use the contact page, the in-app Feedback screen, or [email protected]. Those channels all reach Tempered Software LLC. We'll update this policy as Tempered grows, and note the date at the top whenever we do.