LittleFoundry

Winston

Privacy policy

Last updated

Winston doesn't collect anything about you for LittleFoundry. It talks to the Mastodon servers you choose, and keeps everything else on your PC.

The short version

  • Winston has no LittleFoundry account, and no analytics, ads or tracking of its own.
  • It connects to the Mastodon servers you sign in to, and to websites only when you open them.
  • Your settings, accounts and drafts are stored on your PC, and your sign-in tokens are encrypted by Windows.
  • Winston comes from the Microsoft Store, so Microsoft's privacy statement covers installing and updating it.

What Winston stores on your PC

Winston keeps its data in its own folder on your PC:

  • Accounts: the servers you've signed in to and an access token for each. Tokens are encrypted with Windows' Data Protection API (DPAPI), so only your Windows user account can read them.
  • Settings: your preferences, such as theme, columns and keyboard shortcuts.
  • Drafts: posts you closed without posting, including their attachments and descriptions, until you post or discard them.
  • Web panel data: when you open links inside Winston, Microsoft Edge WebView2 keeps its usual browsing data (such as cookies and cache) in a folder of its own.

Signing out of an account in Winston asks your server to revoke Winston's access and removes the account from your PC.

Who Winston talks to

  • Your Mastodon servers. Everything you see and do in Winston, such as reading feeds, posting, uploading media, translating posts and receiving notifications, goes directly between your PC and the servers you sign in to. Those servers' own privacy policies apply to what you share with them.
  • Other Mastodon servers, when you ask. If your server is too small for trends of its own, you can choose to show another server's trends (mastodon.social unless you pick another). Winston then reads that server's public trends.
  • Websites you open. Links you open in Winston's web panel load directly from those websites, just like in a browser. Ctrl+click opens them in your own browser instead.
  • Images and media. Pictures, videos and link previews in posts load from the servers that host them.

Winston doesn't send any of this to LittleFoundry.

Features that stay on your PC

  • Text recognition ("Use text in the image" and "Text in image") uses the text recognition built into Windows. Images are read on your PC and aren't uploaded anywhere for it.
  • Catch up picks out the posts you missed on your PC, from the feed your server sends.
  • Notifications are shown with Windows' own notifications.

The Microsoft Store

Winston is installed and updated through the Microsoft Store, under the Microsoft Privacy Statement. Microsoft gives app publishers reports in Partner Center, such as how many people installed an app, its ratings and reviews, and crash reports that Windows collects according to your diagnostic data settings (Settings → Privacy & security → Diagnostics & feedback). LittleFoundry uses these reports only to see how Winston is doing and to fix problems.

Signing in

Winston signs in with your server's standard OAuth flow: it opens your browser, you approve Winston on your server's own page, and the server gives Winston an access token. Winston never sees your password.

Changes

If Winston starts handling data differently, this page will be updated first, with a new date at the top.