This policy covers Starkive Manifest for macOS and Starkive Scanner for iPhone, together “the apps”. They are one product and share one register.
Last updated 5 August 2026 · Depalo Consulting LLC
Starkive Manifest has two workspace modes, and which one you choose decides everything on this page.
LOCAL Your register is a file on your own Mac. The apps talk to each other over your own network and to nothing else. We receive no data of any kind. There is no account, no telemetry, and nothing for us to hand over, lose, or be compelled to produce.
CLOUD Your register syncs through infrastructure we operate so your devices agree with each other. We do store your inventory. Some of it we can read; the most sensitive parts are encrypted on your device with a key we never receive, and those we cannot read even if asked. The rest of this page is precise about which is which.
We would rather lose a sale than be vague here. If a sentence below is not what you assumed, that is the sentence doing its job.
Depalo Consulting LLC (“we”, “us”) is the developer of the apps and, for cloud workspaces, the controller of the data described in section 3. Reach us at [email protected].
A local workspace stores its register in a database file on your Mac, inside the app’s own container. A paired iPhone holds its own copy and syncs directly with that Mac over your local network, using TLS with a certificate the phone pins at pairing time.
In this mode we collect nothing. No account is required, no analytics are sent, and no part of your inventory is transmitted to us. If you never turn on a cloud workspace, we never hold anything belonging to you.
Two things in this mode may send data somewhere that is not us, and both are yours to switch on:
A cloud workspace syncs through a Supabase project we operate, hosted in the United States, so that a Mac and a phone can hold the same register without being on the same network. This is the mode in which we hold your data.
Stored so it can be indexed, searched and synced:
Encrypted on your device before it is sent, with an organisation key generated on your Mac or iPhone. That key is wrapped to each device you admit and to a twelve-word recovery phrase shown once, which you write down. We never receive the key or the phrase. If every one of your devices is lost and the phrase is gone, this data is unrecoverable — by you and by us. That is the trade, and it is deliberate:
Rows are separated per organisation and enforced at the database, not in the app. We do not read customer records as a matter of course; staff access happens only where you ask for support and only for as long as that takes.
| Permission | Why |
|---|---|
| Camera | Scanning asset tags and pairing codes, and photographing equipment condition. Images stay on the device in a local workspace. |
| Photo library | Attaching a photograph you already took. Only the item you pick is read. |
| Local network | Finding and connecting to your own Mac. Used for nothing else, and never to scan for anything but Manifest. |
| Face ID / Touch ID | Unlocking the register held on the device. Biometrics are handled by iOS; we never see them. |
Subscriptions are sold through the App Store. Apple processes the payment and we never see your card details. We receive confirmation that a subscription is active so the app can unlock, and nothing more.
Local workspaces: you already hold everything. Deleting the app, or the workspace folder, deletes it.
Cloud workspaces: we keep your data for as long as the workspace exists. Email us and we will delete the workspace and everything in it within 30 days, backups included. You can also export your register to CSV from inside the app at any time, without asking us, and we would rather you did that first.
An audit trail is deliberately not editable from the apps — that is what makes it evidence. Deleting the workspace deletes the trail with it.
Depending on where you live you may have rights to access, correct, export, or delete personal data we hold, to object to processing, and to complain to a regulator. For local workspaces there is nothing for us to produce. For cloud workspaces write to [email protected] and we will answer within 30 days. We will not charge you for it and we will not make the product worse for you for having asked.
The apps are business tools, are not directed at children, and we do not knowingly collect data from anyone under 16.
Cloud workspaces are hosted in the United States. If you use one from elsewhere, your data is transferred there. Local workspaces involve no transfer at all, which for some customers is the entire reason to choose one.
If we change this policy we will update the date at the top, and if a change materially affects what we hold or who can read it we will tell affected customers by email rather than relying on you to notice.
Depalo Consulting LLC · [email protected]