Privacy and security

What Geometer does not do#

• No account. You do not sign up for anything.
• No telemetry. The app, the geo command and the workspace collect nothing and report nothing. What the team learns comes from issues that people choose to open.
• No upload of your project. Your code runs in containers on your computer. Outside services are simulated, so nothing real is charged or sent.
• No change to your files by checking. Opening a project only reads it. A check works on a copy inside containers.

The request form on geometer.dev#

The website has two forms: the request for help or for a design-partner evaluation on the contact page, and the updates sign-up in the footer of every page. They are separate from each other and from the app, and the app never sends anything to either. The website itself has no analytics, no cookies and no scripts that watch you.

• What it collects. What you send: a subject, your name, work email, company, role, what your agent does, what is driving the timing, and how you heard about us. If you followed a link from another page of the site, the subject is filled in from that link, and you can change it. If you arrive from one of our campaign pages, it also records that page's campaign code. With each submission, Netlify also records your IP address, your browser's user agent and the page you sent it from, which its spam filter uses.
• Who handles it. Netlify, which hosts the site, stores each submission, and its spam filter, Akismet, checks it for spam. We receive it by email at [email protected], which Zoho Mail hosts, and keep it with our notes in our own records.
• Why. To reply to you and to help. We use it for nothing else.
• How long. Deleted within 12 months of our last conversation, or sooner on request.
• How to have it deleted. Write to [email protected] and we delete your submission, including Netlify's copy, our emails about it and any notes we made about you.

The updates sign-up. It collects your email address, and Netlify records your IP address, browser and the page you sent it from, as with every submission. Netlify stores the submission and Akismet checks it for spam. Messages come from [email protected], sent through Zoho Mail, about once a month: new releases, studies and articles. Nothing is sent before you confirm by replying to our confirmation email. Every message has an unsubscribe line, and replying "unsubscribe" works too. Unsubscribing takes you off the list at once. To have the address deleted entirely, including Netlify's copy of the sign-up, write to [email protected]. We never use it for anything else.

What uses the network#

Geometer's own calls, such as a model download or a call to a hosted model, are written to a ledger that keeps only the host and port. Under the hood shows the network activity Geometer can see, labelled by who made it, and says what it cannot see. See Choose a model for what each model choice sends.

Publishing a certificate link (not switched on yet)#

Certificate links are built into the app but are not switched on: until the service exists there is nowhere to send anything. When they are, this is how they work. It is the one exception to "nothing is sent".

• Only when you publish. Geometer sends a certificate only when you press Publish a link on that certificate or run geo certificate publish, after showing you the exact files and asking you to confirm. Nothing else in the app uploads a certificate, and checking, exporting or previewing sends nothing.
• What is uploaded. The public copy of the certificate with private evidence left out, the evidence files allowed to leave your computer, the signed status, your public key and key log, and a random id of your computer inside the signed status entries. Rule names, the code version, results and the list of what was not checked can say things about your project; read the preview.
• What is stored. Those files, the time of upload and the size. Not your name, email or IP address, and there is no account, no cookie and no analytics on the certificate page. The hosting provider handles requests, including IP addresses, as an infrastructure provider; what it keeps is set by its own terms.
• Who can see it. Anyone with the link. The link cannot be guessed, is not listed or searchable, and the page asks search engines not to index it.
• Who it is published by. You. Geometer stores it and did not check it, and does not vouch for it or for you.
• How to delete it. geo certificate unpublish <id> or Remove the link, signed with the certificate's own key. A record of the id and the time of removal stays. Copies others saved cannot be recalled, and a cached copy can show for a few minutes. If you lost the key, write to [email protected].

The local workspace and its sign-in link#

The workspace (the Mac app's window, or geo open in a browser) is a server on your own computer.

• It listens on 127.0.0.1 only, so other computers cannot reach it, and it checks the Host and Origin of every request.
• You sign in with a one-time link that geo open prints. The link works once and expires after ten minutes. The workspace exchanges it for a cookie that is HttpOnly and SameSite=Strict. The Mac app signs in by itself.
• Scripts on the same computer can use a token file in the records folder instead of the link.
• It accepts only JSON for writes and sends a strict content security policy.
• A link that you click on another web page, for example in a chat or a GitHub issue, still works: a browser opens it as a page load, and the workspace then signs you in from its own page. Everything else coming from another site, such as scripts, frames, form posts and calls to the API, is refused whether or not a cookie is present.
• When it refuses a page load, it shows a small page that says what happened, that nothing was changed, and what to do: use the link that Geometer printed in your terminal, or run geo open again.

The Mac app's window refuses every address outside the workspace. It hands Geometer's own pages (on GitHub and geometer.dev) to your default browser.

What Geometer writes, and where#

Exports such as certificates and the dated audit export go to the records folder, never to your project. Anything that looks like a password or key is withheld from an exported certificate, and Under the hood never shows environment variables or secrets. A key for a hosted model is stored on your computer, never in a file with your settings and never taken from a command line argument. Keep important records elsewhere too: the alpha terms say Geometer may lose or corrupt its own records between versions.

Your records#

The details of each call recorded by Guard (its arguments) are stored locked on your computer. Without the key, a copy of the files does not reveal them. You choose how long they are kept with geo prove retention. You can give someone a credential that can only export a record. See Prove and certificates.

Checking what you download#

Each release lists the SHA-256 digest of every file in SHA256SUMS. The one-line installer checks the digest before it installs anything, and you can check it yourself. The alpha is not signed by Apple. Each download includes the licences and notices of the open-source components inside it. Use is under the alpha terms.

Reporting a security problem#

Please report a security problem privately, not in a public issue. Use GitHub's private vulnerability reporting for Geometer. Say which version and platform you used and how to reproduce it. Do not include secrets, customer data or private code you cannot share. For the policy, scope and what the site has and has not confirmed about response targets, read the security page.

For ordinary bugs, install problems and questions, see Troubleshooting.