DataTray - Privacy Policy

Effective date: August 26, 2026 Product: DataTray Provider: Clearware, LLC, a Delaware limited liability company ("Clearware," "we," "us," or "our") Contact: info@clearware.co | https://datatray.io

---

The short version (plain-language summary)

This summary highlights the key points. The full policy below controls.

• DataTray runs on your device. The files you open, convert, dedupe, clean or compare - and the settings and job history that go with it - stay on your computer. We don't upload them.
• We don't collect your files, filenames, or even your column names. Our crash and usage reporting is built around a code-level allow-list: only a fixed set of non-identifying properties can ever be sent, and everything else is dropped.
• How DataTray is funded - bandwidth sharing. While DataTray is installed, it shares a slice of your idle internet bandwidth when it can through a bundled partner network (Massive) to relay other parties' traffic. Only one Clearware app shares on a device at a time, so this may not run at all if another Clearware product already holds the slot. When it is running, it runs in the background and keeps sharing even after you close DataTray, until you uninstall. It does not read or upload your data. See Section 3. This is disclosed in the Terms of Use and shown by an always-visible status indicator in the app and by Massive's own system-tray icon.
• To operate the network, Massive processes some device data (such as your IP address, an anonymous device identifier, city-level location, device specifications, and bandwidth statistics). Massive is an independent data controller for that processing under its own privacy policy. See Section 3.
• What we do collect is optional and anonymous: crash reports, basic usage counts, and a one-time install signal. You can turn each of these off.
• We don't sell your personal information.
• You have rights to access, delete, and control your data - see Sections 12-13.

---

1. Who we are

Clearware, LLC develops and distributes DataTray, a free Windows desktop utility app for working with data files. This policy explains what information the Software and our related services handle, how, and your choices. It applies to the DataTray application and the datatray.io website's interactions with it. It is incorporated into the Terms of Use.

2. Our core principle: local-first

DataTray is designed to keep your data on your device:

• Every tool runs on-device. Opening, profiling, converting, deduplicating, cleaning, anonymizing and comparing all happen using an analytical query engine bundled inside the app, reading your files where they already sit on your disk. Not one of the five tools makes a network request. The files you process are not sent to us or to any Clearware server.
• There is no upload path to disable. This is structural rather than a setting: the engine is configured with remote filesystems switched off, so no query — including SQL you type or paste yourself — can read from or write to http://, https:// or s3://. Extensions are never auto-downloaded either, so a fresh install does not reach the network the first time you open a spreadsheet.
• The reports are self-contained. The HTML reports DataTray generates reference no external stylesheet, script or font, so opening one does not call out to anybody.
• Your settings and job history are local. Preferences are stored on your device (via a local settings store), and job history is stored in a local database on your device. We don't have a copy.
• No account required. DataTray does not require you to create an account or give us your name, email, or other identifying details to work.

3. The bandwidth exchange (how the app is funded)

DataTray is free because, while it is installed, it shares a slice of your device's idle, unused internet bandwidth when it can through a bundled third-party network operated by Massive and/or its partners (the "Exchange"). Your connection relays third-party internet traffic. This is how we generate revenue instead of charging you or showing ads.

Only one Clearware app shares on a device at a time. The Exchange currently allows a single connected client per machine. If you have more than one Clearware application installed, only one shares bandwidth at any moment; a sibling app that does not currently hold the slot keeps retrying and takes over automatically once it frees up. On a device where a sibling app already holds the slot, DataTray may share nothing for as long as that lasts.

The Exchange runs in the background, including after you close DataTray. The Massive agent starts with your Windows user session and keeps sharing while you are logged in, even after you close or quit DataTray, until you turn sharing off or uninstall. It shares only for the logged-in Windows user; it is not a system-wide service and does not run for other users of the device or at the Windows sign-in screen.

The Exchange does not access your data. Specifically, it does not read, upload, or share your files, the data you process, your browsing or search history, the sites you visit, your credentials, cookies, keystrokes, or screen contents. It relays other parties' traffic - not yours.

What Massive processes to operate the network. To route traffic, Massive processes a limited set of device data: your IP address (during active sessions), an anonymous device identifier, city-level location, device specifications, and connection and bandwidth statistics. Massive retains this data on a capped schedule (currently up to 60 days) and is an independent data controller for it, governed by Massive's own terms and privacy policy, not ours. See:

• Massive license: https://www.joinmassive.com/en/terms
• Massive privacy policy: https://www.joinmassive.com/en/privacy
• Massive SDK privacy policy: https://www.joinmassive.com/en/monetization-sdk-privacy-policy
• Massive FAQ: https://www.joinmassive.com/faq

Resource use. Sharing uses network bandwidth and a small amount of CPU. DataTray does not itself instruct the Massive agent to keep your computer awake; depending on your system and the agent's own default behavior, participating may keep your device awake or reduce how often it sleeps while sharing is active, and otherwise defers to your operating system's normal power and sleep settings.

Your control. You can turn sharing off at any time from DataTray's Settings, DataTray's tray menu, or Massive's own system-tray icon; a stop from Massive's icon is honored and the app will not restart sharing behind you. Note: DataTray's utilities do not run while sharing is off (see the Terms of Use, Section 3). To end participation permanently, uninstall the app, which stops and removes the Massive agent.

4. Information the Software collects

Everything below is optional, off-switchable, and designed to carry no personal identifiers, URLs, filenames, or content.

Why the bands are bands. A size band and a duration band tell us whether people genuinely bring files larger than a spreadsheet can open, and whether a format was worth supporting. An exact file size, row count or column count would tell us something else entirely — a row count can be a headcount, a customer count or a transaction volume — so those are never sent, only the band.

How the "no PII" design is enforced. In the Software, every analytics event passes through an allow-list that permits only the fixed event names and the non-identifying properties above; anything else is dropped. An allow-list rather than a block-list is deliberate: a block-list rots the first time somebody adds a field and forgets to check it, whereas an allow-list fails closed. Every crash report passes through a scrubbing step that removes user/identity fields and redacts URLs and Windows and Unix file paths from the text before transmission. This is a design safeguard, not an absolute guarantee.

5. Information we do NOT collect

We do not collect, and the Software is built not to transmit:

• the names, paths or contents of the files you open, convert, clean or compare;
• your column or field names — a column called q3_churn_risk_score is frequently a business secret in itself;
• any cell value, including anything DataTray identifies as personal data while scanning a file for you;
• exact file sizes, exact row counts or exact column counts, or sheet names;
• the SQL you write, or any find-and-replace or regular expression you type;
• anything derived from the above;
• your browsing history or the websites you visit;
• your name, email address, passwords, payment details, or precise location;
• persistent cross-site advertising identifiers.

6. How we use information

We use the limited, anonymous information we do collect only to:

• keep the Software stable (diagnose crashes and errors);
• understand which capabilities and file formats are used, and how reliably, to prioritize improvements;
• measure install activation in aggregate;
• deliver updates.

We do not use it to build advertising profiles or to identify you.

7. Cookies and tracking

The DataTray desktop application does not use advertising cookies or cross-site trackers. The website does, and rather than describe that in the abstract, here is the exact list of what runs on datatray.io and why:

What we send to the ad platforms, and what we do not. When a download or install happens, our server reports that conversion to Microsoft Advertising and to Google Ads. The Microsoft report contains exactly: the Microsoft click id, the random install id, your browser's user-agent string, the name of the event (for example download, install, or first_open), and a number we assign to weight how meaningful that event is. The Google report contains the Google click id, which conversion it counts as, when it happened, a value, and a transaction id built from the random install id so the same event is never counted twice. Neither contains your IP address, your email address, your phone number, or any hashed version of them. That is not an accident of implementation — we never store a full IP address anywhere in this measurement chain (only a truncated prefix), and we deliberately declined to start collecting any of those in order to improve ad matching.

This is measurement, not targeting. These identifiers exist to count conversions from ads we already paid for. We do not use them to build advertising audiences, we do not run remarketing or dynamic remarketing, and the consent signal we send Google explicitly withholds permission to personalise ads from these conversions. If we ever adopt any of that, this policy changes before it is switched on, not after.

Your controls. The site and the download work with all of this blocked. Your browser's cookie and tracking-protection settings, or any ad/tracker blocker, will stop the Google and Microsoft tags loading and prevent either click id being stored — nothing on datatray.io depends on them. You can also use Google's and Microsoft's own opt-outs, linked in their policies above.

The cookie notice. Where consent is required — the EEA, the UK and Switzerland — datatray.io asks before any of this runs. Until you answer, the Google and Microsoft tags are held in a no-storage mode in which they neither read nor write cookies, and the click ids and install id described above are not stored at all. Choosing Decline keeps it that way, and a download you make afterwards is counted only against the campaign, with no identifier attached and nothing reported to Microsoft Advertising or Google Ads about you. Your answer is remembered in your browser and travels with you; declining here stays in force even if you later visit from elsewhere. You can reopen the notice at any time from Cookie settings in the site footer.

Changing your mind later. If you accepted and then decline — from Cookie settings at any time — we do two things, not one. Your browser's copies of the click ids, the install id and the stored campaign record are erased, and we also tell our own server to stop reporting you, because a click id recorded while you were consenting would otherwise still be sitting there. From that point no further conversion of yours is sent to Microsoft Advertising or Google Ads. Reports already delivered to those platforms are subject to their retention schedules, not ours.

8. Legal bases for processing (EEA/UK users)

Where the GDPR or UK GDPR applies, we rely on these legal bases:

• Legitimate interests - for anonymous crash and usage reporting and aggregate install measurement, to keep the Software secure, stable, and improving, balanced against your privacy (and you can opt out).
• Consent - where required, including your acceptance of the bandwidth exchange and telemetry at first run; you may withdraw consent by disabling the relevant option or uninstalling.
• Performance of a contract - to provide the Software and deliver updates under the Terms of Use.

9. How information is shared

We share information only as follows:

• Service providers (sub-processors): Sentry (crash reporting) and Aptabase (privacy-friendly, anonymous analytics) process the limited data described above on our behalf.
• The Exchange operator: Massive and/or its partners operate the bandwidth-sharing network as an independent data controller, subject to their own terms and privacy practices. Massive is not our service provider or processor for that activity.
• Update and website hosting providers deliver updates and run datatray.io.
• Legal and safety: we may disclose information if required by law, or to protect the rights, safety, or property of Clearware, our users, or others.
• Business transfers: if Clearware is involved in a merger, acquisition, or asset sale, information may transfer as part of that transaction, subject to this policy.

We do not authorize these providers to use the data for their own unrelated purposes.

10. We do not sell your personal information

We do not sell your personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined under the California Consumer Privacy Act (CCPA/CPRA) and similar U.S. state laws. Because the Software is built to avoid collecting personal identifiers in the first place, there is very little personal information involved at all.

11. Data retention

• On your device: your files, settings, and job history remain until you delete them or uninstall the app.
• Crash and usage data: retained by our providers for a limited period consistent with diagnosing issues and understanding trends, then deleted or aggregated.
• Install-attribution signal: retained in aggregate/measurement form; the random install id is not linked to your identity.
• Microsoft click id (msclkid) and Google click id (gclid): each stored in your browser for 90 days from your most recent ad click, then it expires; a newer click replaces an older one. Where one has been used to report a conversion, the platform's own copy is subject to its retention schedule, not ours.
• Consent withdrawal: if you decline after having accepted, we keep a minimal record that you withdrew — the anonymous install id and the date — because that record is what stops any further conversion being reported for you. It contains nothing else.
• Exchange data processed by Massive: governed by Massive's own retention schedule (currently capped at up to 60 days), under Massive's privacy policy.

12. Your privacy rights

Depending on where you live, you may have rights to:

• access the personal information we hold about you;
• correct inaccurate information;
• delete your information;
• object to or restrict certain processing, and withdraw consent;
• portability of information you provided;
• non-discrimination for exercising your rights.

Because DataTray is local-first and largely anonymous, the fastest way to exercise most of these rights is directly in the app - turn off telemetry, turn off bandwidth sharing, delete your local data, or uninstall. To make a formal request, or if you're in the EEA/UK, California, or another region with statutory rights, email info@clearware.co and we will respond as required by law. You may also have the right to lodge a complaint with your local data-protection authority.

For rights relating to the data Massive processes to operate the Exchange, contact Massive through the privacy policy linked in Section 3.

13. Your choices and controls

You are in control of the optional data flows:

This policy does not claim automatic pausing on metered connections or during active use, and does not claim a bandwidth cap. Those controls are not part of the shipped build.

14. Security

We design the Software to minimize the data at stake: processing is local, the renderer runs sandboxed and isolated from system APIs, privileged work is confined to the app's main process behind a typed bridge, and bundled or downloaded binaries and models are integrity-verified (SHA-256) before they run. No method of transmission or storage is completely secure, but we take reasonable measures to protect the limited information we handle.

15. Children's privacy

DataTray is not directed to children under 13 (or the minimum age required in your jurisdiction), and we do not knowingly collect personal information from them. If you believe a child has provided us personal information, contact info@clearware.co and we will address it.

16. International data transfers

We are based in the United States, and our service providers may process data in the U.S. and other countries. Where required, we use appropriate safeguards (such as standard contractual clauses) for transfers of personal data out of the EEA, UK, or other regions with transfer restrictions.

17. Changes to this policy

We may update this Privacy Policy to reflect changes to the Software, our practices, or the law. When changes are material, we will update the effective date and provide reasonable notice (for example, in-app or on datatray.io). Your continued use of the Software after an update takes effect constitutes acceptance of the updated policy.

18. Contact us

Clearware, LLC Email: info@clearware.co Web: https://datatray.io

For privacy requests, please put "Privacy Request" in the subject line so we can route it quickly.

---