# Open Capslox Console Privacy and Security Note

This note is the short customer-facing explanation for the commercial Windows GUI. Keep it factual and update it before every paid release if storage, sync, billing, support, or update behavior changes.

## Local Keyboard Access

Open Capslox uses a local keyboard hook so CapsLock combinations can trigger cursor movement, selection, editing, and profile-defined actions. The hook runs on the user's Windows device.

The open core does not send keystrokes, active window titles, typed text, clipboard contents, documents, screenshots, or application content to Open Capslox services.

When app exclusions are enabled, the core reads the foreground process executable name, such as `code.exe`, to decide whether remapping should pass through. It does not need the document name or window title for that decision.

## Local Files

Installed Windows builds store local state under `%APPDATA%\open_capslox` and local support logs under `%LOCALAPPDATA%\open_capslox\logs`.

Important local files include:

- `config.toml`: active open-core keyboard mapping config.
- `profiles.json`: closed-GUI profile list and profile snapshots.
- `commercial-state.json`: account status, device binding, sync queue metadata, and local Pro state.
- `gui-events.jsonl`: recent closed-GUI runtime errors used for support diagnostics.
- `support\open-capslox-support-<timestamp>.json`: support bundle generated only when the user or QA flow exports it.

Portable builds keep using an adjacent `config.toml` when one exists beside the executable.

## Pro Cloud Sync

Pro sync sends only the data needed for account and profile synchronization:

- email address used for license verification,
- license key during verification,
- generated device id and device name,
- profile name, profile scope, profile mapping count, updated timestamp, and TOML profile snapshot,
- sync action metadata such as upload, list, download, or delete.

License keys are not stored in full after verification. The GUI stores a short hint and an entitlement token. Support bundles redact entitlement tokens and do not include full profile TOML snapshots.

The open core remains usable without a Pro account. Expired, revoked, or unavailable Pro status disables Pro-only GUI sync/profile expansion, but local keyboard mapping continues to run.

## Support Bundles

Support bundles are written locally and are not uploaded automatically. A bundle can include:

- open-core diagnostics and recent core log lines,
- profile summaries without full TOML snapshots,
- redacted commercial account and sync queue state,
- recent closed-GUI runtime events,
- service health, production readiness, warnings, and failures.

Support staff should ask users to inspect or share the generated support bundle only when troubleshooting.

## Updates and Signing

Commercial GUI update checks read the configured release manifest URL. Downloads are saved under `%APPDATA%\open_capslox\updates`, checked against the manifest SHA256, and verified with Windows Authenticode before the GUI starts an installer.

Production builds should set `OPEN_CAPSLOX_SIGNER_SUBJECT` so the GUI requires the expected publisher subject before launching a downloaded installer.

## Service Boundaries

The GUI may call the closed license, sync, update, and billing-backed services. The open core does not call those services and does not contain billing or entitlement logic.

Billing webhooks are server-to-server only. The GUI never calls billing ingestion endpoints.

## User Controls

Users can:

- run the app without signing in and keep local Basic keyboard control,
- sign out from Pro while keeping local config and profiles,
- export support data locally,
- uninstall the app through Windows uninstall flow,
- disable auto-launch through the app or uninstall flow.