Your collection stays yours.

Local organization

File contents and video frames are never uploaded by the organizer. Scanning and filename previews run on your device. Relative mapping paths are shared only when you explicitly submit a community rule. The desktop app copies, verifies and moves files locally. It does not use the previous AI frame-recognition workflow or store account-linked file history.

Optional folder matching

When you explicitly check a folder fingerprint, the app sends only a SHA-256 hash of sorted relative filenames to the rule lookup endpoint. This describes a naming layout, not file contents. Hashes are not encryption: someone with the same list can reproduce the hash and recognize a known collection. The application does not save lookup requests or associate them with an account.

Desktop automation API

The desktop app exposes a token-protected API only on your computer. A client you give the session token can read folder names and request copy or move plans. Transfers still require desktop confirmation. Tokens, scan snapshots and plans stay in memory; the app does not keep API request history. You can reset the token or disable the API in the desktop Local API panel.

Network shares

SMB passwords are passed to your operating system to connect to the share and are never saved by QMInventory. Saved locations contain the name, address and username on your device. The last 20 successful connections also keep a local connection time so you can return to recent shares. You can delete saved locations and clear recent connections in the app. This information is not sent to our server. Your operating system manages the mounted connection.

Optional TV and movie guides

When you submit a series title or select a show, our server requests public episode metadata from TVmaze. We send no account credentials or local filenames. TVmaze receives the submitted title or series ID and our server’s IP address. Public results are cached under shared keys, with no caller identity or per-user search history. Search keys are hashed; a known query can still reproduce that key. Hosting and provider operational logs may exist.

Search results are refreshed after one hour and episode guides after one day. During provider failures, older results can be shown with an explicit notice: up to one extra day for searches and seven extra days for guides. Exported metadata retains TVmaze attribution and its CC BY-SA 4.0 license. Movie title searches use Wikidata’s CC0 public metadata, cached for one day with up to seven additional days of disclosed stale results during failures. The same title-only request and shared-cache privacy approach applies.

Desktop box art is optional. Loading artwork or opening a linked title requests its public metadata ID. Movie and OVA artwork uses the Wikipedia article linked by Wikidata. The desktop loads cover images directly from TVmaze or Wikimedia without a referrer; those image hosts receive your IP address. We cache metadata and image URLs, not your media. Artwork retains its owners’ rights.

Rules and feedback

Submitted rules contain a title, description, tags, mapping and optionally a folder fingerprint. Mixed collection rules can contain relative folder and file paths that you chose to map; inspect these before sharing. These are intended for publication after review. Do not put personal paths or confidential information in submissions. Rules are declarative JSON, not executable scripts. The library stores vote and issue receipts separately for each rule version, along with aggregate counts. Receipts contain a hash of a random secret, the vote or issue category, and a creation time for rate limits. They contain no voter account, username, IP address or global device identifier. The secret stays in your browser or app and is sent only when you give feedback on that rule version.

Publishing uses a separate private management token for each rule. Its hash is stored privately; the token lets you update or withdraw the rule without a public author profile. Keep your exported key private. New versions require moderation again and start fresh vote counts. Losing local storage without a backup loses these keys.

Reports queue rules for review; dislikes do not automatically remove them. Submission and feedback bursts are limited in the database. A new receipt can still be generated, so this system does not prove one person per vote. These protections do not establish anonymity from hosting or network providers.

Public page counts and error reporting

We count visits to the home, guide, download and privacy pages. Community, account, organizer and API routes are excluded. The page counter sends only a fixed page path and site identifier, without cookies, query strings, referrers, local filenames or a browser identifier. Our proxy replaces the caller’s IP address and browser information before forwarding these counts to our analytics service. It does not return a tracking token. We respect Do Not Track and Global Privacy Control for these counts.

Automatic error reporting is limited to those same public pages. Error messages, request bodies, headers, cookies, user records, breadcrumbs and custom context are excluded. Reports contain an error category and available compiled-code locations. We do not enable session replays, performance traces or rule-run tracking. Your browser still connects to the hosting and error-ingestion servers, which can observe network information.

Accounts, support and operational logs

Signing in stores your email and authentication records in Supabase; authentication audit records can include an IP address and time. Support requests and beta signup are separate, voluntary services: their forms may send your supplied contact information, account session and page/device context to Programming Securely. They are not anonymous Community votes or rule publications.

Infrastructure can retain operational errors and request information. Container logs rotate at three files of up to 10 MB per container; this is a size limit, not a deletion deadline. Routine database gateway access logging is disabled, and existing log collectors are scoped to their own projects. Privileged infrastructure operators can still access these services.

Hourly cleanup removes this project’s aggregated operational logs, analytics events and error-event payloads older than seven days, and authentication audit records older than 30 days. Analytics sessions remain while recent retained activity refers to them. Cleanup can be delayed by failures. Error issue summaries and community rules, revisions and feedback receipts have separate storage and are not expired by these jobs.

Earlier analytics records may contain visitor-derived session identifiers until they expire. Historical copies in other projects’ log stores, backups and external services are not fully verified or covered by these cleanup jobs. We do not claim end-to-end anonymity or zero infrastructure logging.

During beta

No payment details are collected by this application; checkout has not launched. Community actions require the rule-library database migration to be installed. The interface reports when that service is unavailable.