Licensing, privacy, and network access

Equarith is local-first. Dataset import, editing, statistics, symbolic-regression search, analysis, prediction, project storage, checkpoints, and exports run on your computer and do not require a computation service.

License modes

Without an activated certificate, Equarith runs in Demo mode. A Demo search uses the first 200 source rows and up to four input variables. All other loaded data remains available for viewing, editing, saving, and later licensed use.

Academic and Pro certificates remove those two licensing limits. They do not remove normal memory, finite-data, structural, or engine safety limits.

The current mode appears in the application badge. A failed or invalid activation falls closed to Demo rather than granting unverified access.

Activation

Online activation sends only the information needed to issue an installation-bound certificate:

• the entered license key;
• the installation Ed25519 public key and a non-reversible machine binding;
• a signed proof over a short, one-use server challenge;
• a device name;
• the Equarith version; and
• protocol metadata needed by the license service.

The service returns a signed certificate. Equarith verifies its Ed25519 signature and claims locally, so ordinary licensed use can continue offline until the certificate expires.

The raw license key is not stored. The installation private key is encrypted locally using account-level operating-system protection (DPAPI, macOS Keychain, or Secret Service when available) and a machine binding. The desktop application and equarith-headless share this state under the same system account. A license is intended for one active machine unless the commercial terms explicitly say otherwise.

Copying the license file to another computer does not activate it: the certificate must match both the private key and the machine. This protection does not replace account and disk security; a local administrator able to alter the program is outside the protection model.

Certificate renewal and deactivation

Certificates are short-lived, with a maximum validity of 30 days in v1.0.3. They can be refreshed online before expiry without re-entering the commercial key: Equarith proves possession of the installation private key. If the network request fails, the last valid certificate remains usable until its expiry time.

Deactivate before permanently moving the license to another computer. Deactivation sends the certificate identifier and a new signed proof; Equarith switches to Demo only after the service confirms release. If the request fails, the local licensed state is not silently discarded.

Do not delete local license files as a substitute for server deactivation.

Network features

Equarith has no runtime network dependency for data or computation. Network access occurs only for:

• startup or manual update checks, which retrieve release version, channel, and publication information;
• explicit license activation, refresh, or deactivation;
• explicit feedback submission after you select Send;
• encrypted anonymous error reports from the desktop application when the enabled-by-default setting remains on; and
• opening an official purchase, documentation, or download page in your browser.

An update request does not contain your dataset, project, formulas, or results.

Feedback sends the message you entered plus basic version and platform context. It does not automatically attach a dataset, formula, project, checkpoint, or log. Do not paste confidential information into the message. If the feedback service is unavailable, local work is unaffected and you can retry later.

Automatic error reports contain only the Equarith version, a coarse operating-system and architecture label, exception types, and bounded sanitized code stack frames. Equarith does not include exception messages, absolute paths, thread or device names, identifiers, datasets, projects, formulas, results, checkpoints, or logs. Before transmission, the report is encrypted with a fresh AES-256-GCM key; that key is wrapped with the service's RSA-OAEP SHA-256 public key. The service decrypts it only on the backend. As with any Internet request, the server and its reverse proxy process the source IP transiently to apply abuse limits; the application retains only a salted in-memory hash that disappears on restart, and access logging is disabled for these routes. Aggregated diagnostics are retained for no more than 90 days after their last occurrence and can be deleted earlier by an administrator. Sending is best effort and never blocks local error handling or recovery. You can turn it off at any time in Settings; resetting all settings turns the documented default back on.

Local files and logs

Preferences, logs, recovery archives, encrypted installation identity, and license certificate are stored in the per-user application-data directory. The desktop application and CLI use this same directory. Projects and exports are written only to paths you choose.

Structured logs focus on application events and errors and do not intentionally record dataset cell values by default. Nevertheless, file names, paths, column names, formula text, or error context may be sensitive. Review and redact a log before sharing it.

Recovery archives can contain project data. Protect the application-data directory using normal operating-system account and disk security.

Privacy checklist

• Keep datasets and projects in access-controlled directories.
• Use embedded project data only when recipients should receive the observations.
• Review formulas and prediction exports for sensitive variable names or derived values.
• Redact logs and screenshots.
• Do not enter confidential material in feedback.
• Disable automatic error reports in Settings if your organization forbids diagnostic network traffic.
• Deactivate a licensed machine before disposal or reassignment.
• Back up valuable projects using your organization's approved storage.

For storage paths, see Installation and updates. For recovery contents, see Projects, recovery, and checkpoints.