SPACEPILOT PRIVACY NOTICE Publisher review / updated 29 October 2026 LOCAL PROCESSING WhimRoom processes requested files on this computer. This build has no WhimRoom account, advertising, analytics upload, crash-upload service or remote update service. Windows, Microsoft Store, cloud storage providers and third-party applications operate under their own policies. WHAT THE APP READS Storage and cache scans inspect paths, file types, sizes, times, native file identities and, where available, allocation and filesystem metadata. Exact matching, reviewed cleanup, renames/organization, copies, archives, backup and recovery can read full file contents and hashes. Optional NTFS metadata operations also inspect named streams, extended attributes and supported permissions. These can contain private data in addition to a file's main contents. Document and media tasks read and decode the selected sources locally. PDF reading, OCR and local document categorization use bundled local workers and models. Extracted text and decoded media observations are kept in job/process memory unless an explicit supported save or export is requested. A saved reading contains extracted text and source evidence; its protected form uses Windows current-user protection. Do not treat ordinary exports as encrypted. Browser/application cleanup adapters target recorded temporary/cache locations. Browser passwords, cookies, browsing history, sessions and offline website stores are not targets of these cache adapters. A size, age or classification alone is not permission to remove a file. OPTIONAL AI / MCP CONNECTION MCP runs locally over the configured client's standard input/output; it opens no network listener. The connected assistant can receive paths, metadata, hashes, analysis results, matching rule terms and proposed operations. Explicit document page, search and text tools can share extracted text with that client. The assistant/client provider may process or retain these results under its own policies. Connecting MCP is not a promise that information stays local to WhimRoom once it has been returned to the client. File workflows enforce the local roots approved for that connection. Explicit system inventory tools can separately expose application registrations and startup metadata; that inventory is not limited to approved document folders. Startup commands are omitted unless explicitly requested. Source suggestions use path metadata and extension hints, without reading contents or starting a job. Interactive file changes require separate native review; a model argument cannot approve them. Most MCP jobs and unsaved previews live in connection memory. Approved operations write durable receipts. Supported resumable copy/restore workflows also save queues in the shared local Transfers catalog, including workflows prepared through MCP. Closing a client does not remove those queues, partial outputs, operation receipts or completed outputs. WHAT IS SAVED Settings, protected folders, rules, examples/categories, profiles, tool preferences, saved automation configuration, history, checkpoints and operation records normally live under: %LOCALAPPDATA%\Copperwhim\WhimRoom When automatic history is enabled, the storage journey saves one bounded local space-plan summary beside the settings file. It contains the selected and optional comparison folder, inspection depth, optional goal, observation/save times, observed file counts and logical sizes, available/capacity observations, partial-coverage status and last outcome text. These paths and summaries are ordinary local plaintext. The summary contains no file inventory, content hashes, file selection, approval or executable proof. Reopening it requires a fresh inspection before file changes. Turn off automatic history to stop new summary writes, or use Forget saved space plan to remove this summary without removing files, receipts or other history. Receipts, checkpoints and queues can contain original/destination paths, file identities, times, sizes, hashes, selected policies, metadata evidence, errors and completion details. Supported NTFS queues can include stream names and hashes, extended-attribute values and supported security descriptors. Startup recovery records use Windows current-user protection. Regular receipts and reports are not automatically encrypted. Backups and interrupted backup stages remain in the chosen library. They can contain file contents, original paths, metadata, portable named-stream sidecars, hashes and partial progress. Backup/transfer interruption preserves recorded partials for review and resumption. Unknown or interrupted backup stages are not automatically deleted. Ordinary verified backups are not encrypted; authenticated file-protection tools are a separate explicit workflow. AES ZIP protects file contents; entry names and folder layout stay visible and are not authenticated. Opening a ZIP without authenticated encrypted file contents does not authenticate its data; the operation result distinguishes that coverage. Users choose locations for exports, saved readings, photo reviews, backups, archives and other outputs. Those files can outlive the app and may expose private paths or document contents. Clipboard copying and Explorer navigation are explicit actions. CHANGES AND AUTOMATION Reviewed temporary-file, verified offload-source or explicit selected-history deletion is permanent, bypasses Recycle Bin and provides no automatic backup or Undo. Receipts record actual outcomes and dated available-space observations; these observations can also be affected by other applications. Explicit duplicate recycling requires Windows recycling confirmation and stored-content checks. Restore recycled items through Windows Recycle Bin; recycling alone may not free disk space. Optional automatic document filing uses the saved bounded folder/rule policy after native activation. Its configuration and receipts remain local; it can move matching documents while active. Supported saved resume permission is a separate native choice. Stop watching or close the app to stop the active watch. MCP configuration inspection does not activate it or prove a GUI watch is live. Optional scheduled scans and archive tasks use Windows Task Scheduler only after explicit registration. Plans, source/library paths, options, errors and execution outcomes are stored locally. Scheduled archive tasks create new outputs under their configured limits; they do not silently replace originals. Application/startup inventory reads Windows registry and current-user Windows package/task APIs. Startup changes require review and keep recovery evidence. Launching an explicitly reviewed uninstaller starts third-party or Windows behavior under that application's policies; launch is not proof of removal. RETENTION AND CONTROL Scan-history retention removes only recognized owned scan history according to the configured policy. Reviewed backup retention can permanently remove the selected verified old versions. Operation receipts, queues and user-chosen outputs are not all erased when a session closes. Keep recovery evidence until you no longer need it. Deleting a saved reading, receipt, backup or history file can remove the information needed for later review or recovery. PUBLICATION STATUS This notice is prepared for publisher review; it is not a Store certification statement. The publisher's verified public identity, contact and hosted HTTPS privacy URL must be completed before Store submission. Private registration/identity papers are excluded from the distribution package. Optional folder access-rule backups retain owner and group security identifiers and access rules in the local backup manifest and pending/restore queues. These identifiers may identify Windows users or groups. Folder preview results shared through MCP report whether rules are captured; raw security descriptors are not included in ordinary folder observation listings. Backup and queue files retain the evidence for restoration. For optional encrypted7z creation, the native review accepts a password and confirmation. The password is transiently held in app/worker memory and sent over private redirected input to the pinned local engine. It is not sent as a process command argument or included in the stored preview, execution receipt or ordinary MCP result. Password controls clear when execution starts or review closes. Source paths and selected-member hashes remain in the ordinary archive receipt. Microsoft Store update checks The App updates check is started by the user. For a Store-installed release, it asks the Windows Microsoft Store service for package updates for this app. This action does not scan or transmit personal file contents through WhimRoom, and does not download or install updates. Opening the Store is a separate user action; the Store account and Microsoft service policies apply. Development and local test builds do not claim a verified Store update status. TASK HISTORY AND REVIEWED CLIENT SETUP /0.212 Bounded terminal MCP summaries may persist locally, protected for the current Windows user with DPAPI: at most64 records and30-day visibility, without extracted document text or executable approvals. Currently approved folders filter returned records. Old jobs/approvals are never reactivated by history. Existing queues/receipts retain their separate policies. Native setup can update ONLY the selected JSON client's WhimRoom server entry after user review. Its original settings and bound rollback target/digests are protected together in ConnectionBackups under the app data folder. Original client settings can contain secrets. These backups are local protected data, not uploaded reports. Rollback refuses a changed live file. No client is reconfigured, restarted or connected merely by opening setup or running the local stdio diagnostic. USER FILING CONVENTIONS /0.213 User-chosen folder labels and filename patterns are part of local previews and action receipts. Original/current destinations and source hashes support result location and fresh recovery checks. Local previews need no external client/account. Requested MCP results can share paths, document text and routing labels with the configured external client/provider under its own policies. Selecting a local destination is not blanket permission to an external service. User file/folder labels may themselves be private. SCHEDULED SCAN STATUS /0.245 Read-only scheduled scans save a bounded last-run status in the app data folder: source folder, completion/skip/failure reason, times, file count and application version. Full file-path scan history is saved only when automatic history is enabled. Existing user task registrations are checked before replacement or removal. No passwords are stored; tasks run as the signed-in current user with least privileges. CONNECTED STORAGE COPY STATUS /0.246 Copy receipts retain source/destination/temporary paths, file identity, content digests and interruption/cleanup outcomes. Only newly created unpublished files held by the operation can be discarded automatically. Existing user files and unknown or ambiguously published files are not automatically deleted. Cancellation targets only the operation's own Windows I/O thread and is drained before it returns to other work. ARCHIVE/FILING TASK OWNERSHIP /0.247 Archive and document-filing task registration/removal checks the existing command, exact saved-plan arguments, current-user interactive principal, least privilege and action description. A foreign same-name task is retained; no new filing permission or archive plan is saved when ownership is refused. Temporary test tasks use isolated fixtures and are removed after acceptance. Compatibility: internal executable, protocol identifiers and the existing Copperwhim/SpacePilot user-data directory are retained. No Windows startup entry is added automatically. DURABLE FILE SEARCH /0.260 The optional file index stores plaintext names, paths, sizes, dates, folder/file flags, source directory identities, refresh state, pending directories and change observations in a local SQLite database. It reads directory metadata, not source file contents, and does not modify source files. Initial storage is under the existing user-data folder/FileIndex; you can choose another ordinary local folder under Indexed locations and storage. Newly created index directories restrict access to the current Windows user and SYSTEM. The index database is not encrypted. Existing chosen directories retain their permissions. Windows file-change notifications are monitored while the owning WhimRoom process is open. Watcher errors/overflow, unavailable locations, denied directories, cancellation and capacity limits require refresh and are not represented as a complete current filesystem view. Startup reconciliation covers changes while the process was closed; there is no new Windows startup registration, service, elevated permission or automatic source-file deletion. Saved data can be searched without re-reading sources and can be stale. Index metadata never authorizes file changes. Saved indexed locations survive restart. Removing a saved location removes its search records without changing source files; it is not a secure erasure of SQLite pages, journal files or backups. Selecting another storage folder opens a separate index and preserves the previous database. Source paths in the index may be sensitive. MCP index/search tools operate within their current approved roots; returning saved paths to an external assistant is subject to that client's privacy policy. The bundled SQLite runtime is used locally; WhimRoom does not load SQLite extensions or contact a remote indexing service. 0.261: When existing NTFS journal access is available, the local index additionally stores directory reference IDs and the journal identity/cursor to reconcile downtime. Volume-wide change records are read transiently; queued metadata updates remain inside the selected indexed source and exclude its index-storage tree. No source content read, journal creation/reset, Windows service, automatic elevation or new network connection. Without volume access the index retains its visible notification/reconciliation fallback.