Skip to content

Privacy Policy — Hecate Capture

Effective date: 2026-06-11 Developer: Matthias Morath

Hecate is a field tool for geo-referencing physical objects. It collects only what is needed to identify and locate the assets you record. There is no hosted backend operated by the developer, and no third-party analytics or tracking of any kind.

What we collect

What the app captures is defined entirely by the profile your organisation's administrator configures — a profile is a customizable form describing the fields and scans for one use case. We, as the developer, neither create these profiles nor ever see them or the data you capture against them. What any given deployment collects is therefore decided by your administrator, not by us.

For a typical profile the app handles:

  • Asset details you enter or scan (e.g. serial number, order number, type).
  • Precise location (GPS) at the moment of capture — only if you grant the location permission. You can decline or revoke it in iOS Settings at any time; the app still works without it.

Where it goes

Asset data is published only to the MQTT broker you configure. You choose and control that broker. The developer operates no server, receives none of your data, and never sees the profiles you use or the assets you capture against them. There is no advertising, no profiling, and no cross-app or cross-website tracking.

Storage and security

  • Assets are stored on your device until you delete them.
  • The broker password is held in the iOS Keychain — never in plain text and never written to logs.
  • Connections to the broker can use TLS (mqtts) so data in transit is encrypted.

Data sharing

We do not sell, rent, or share your data with third parties. The only transmission is the publish to your own MQTT broker, performed on your behalf at your direction.

Your choices

  • Location: grant, decline, or revoke at any time in iOS Settings → Privacy.
  • Photos: none. Hecate Capture cannot take a photo — the capability was removed, not switched off, because a photo cannot travel to an MQTT broker and Hecate runs no image backend. Reading a QR code from a photo you pick is a different thing: the image is decoded on-device and never stored or sent.
  • Deletion: delete any asset on-device at any time. Data already published to your broker is governed by your broker's retention.

Diagnostic reports you send us

There is exactly one exception to everything above, and it is your decision every time: under Settings → Event log you can send us a report if you would like help. It never happens by itself.

  • You see the whole report before it leaves the device — nothing is added after that screen.
  • You decide each single time.
  • You send it from your own mail app. The app sends nothing in the background; there is no server of ours it could send anything to.
  • It contains: device and system version, app and core version, your plan (free/pro) and log lines. Never photos, location fixes, passwords, tokens or broker credentials — matching patterns are replaced before sending.
  • A comment and a reply address are optional. We use the address solely to answer that one report.

If you would rather keep the report or hand it to your own IT: "Share …" on the same screen gives you the same information as a text file, without us seeing any of it.

Desktop application (Windows, macOS, Linux)

This is the privacy policy of Hecate's desktop applications, Capture and Admin for Windows, macOS and Linux. There is no hosted backend of our own: your data goes to the MQTT broker you enter, and whoever runs that broker is responsible for it.

What we collect

The asset data you enter or scan and — if you enter one — the station's position, which you set once by hand; it is attached to every capture. The application reads no device location, takes no photos and collects no analytics or advertising identifiers.

Permissions

The desktop applications ask for no permissions: no camera, no location, no Bluetooth, no access to your photos. A scanner presents itself to the operating system as a keyboard or as a serial port; the application reads only what it sends.

Where data goes

Captures and profiles go only to the MQTT broker you enter — encrypted with TLS, unless you switch TLS off yourself for a broker without encryption. There is no Hecate backend and no third-party analytics, advertising or tracking service. The licence is checked without a network. What happens to the data after it reaches your broker is up to its operator, not Hecate. An event log reaches Hecate only when you send it yourself from your e-mail program, after seeing it in full (see "Terms and privacy").

Storage & security

Settings, profiles, your captures, the licence and the event log are files in your user folder on this computer. The broker password lives in the operating system's keyring — the macOS Keychain, the Windows Credential Manager or the Secret Service on Linux —, never in plain text in a file and never in the log. The event log stays on the computer until you save it and pass it on yourself; passwords and credentials are replaced when you do.

Retention & deletion

You control retention on the computer: delete a capture or a profile and it is removed from local storage; deleting a capture also cancels its pending sends. The event log keeps at most two files of about one megabyte each and overwrites the older one. What has already reached your broker is kept there according to its configuration; Hecate cannot delete it there for you.

Third parties

The applications are built from open-source Rust libraries, among them rumqttc for the connection to the broker; the full list with their licences is under "About". No analytics, advertising or tracking libraries are included. The only network destination is the broker you enter.

Your rights

Because your data lives on your computer and on your broker, you can exercise most privacy rights directly — view and edit entries in the application, delete them from the computer, and manage retention on your broker (access, rectification, erasure). For anything else, contact the controller named below. Depending on where you live, you also have the right to lodge a complaint with a data-protection authority.

Controller & contact

Hecate is developed by MMM Software & Consulting. When you run Hecate against your own broker, you (or your organisation) act as the controller for the data you capture. Questions about this policy: by e-mail to info@hecateapps.com. Last updated: September 2026.

Children

Hecate is a professional/field utility and is not directed at children.

Changes to this policy

If the app's data handling changes, this page and the in-app Settings → Privacy screen will be updated together.