Asheo — Network & Privacy Disclosure

Asheo is a developer/QA tool. It talks to its own license/update server (a

Cloudflare Worker) for two reasons only: to validate your premium entitlement and

to check for new builds. This document states exactly what is and isn't sent.

What Asheo sends to the server

The only fields sent are:

  • installId — a random UUID generated locally on first run. It is not a

hardware or browser fingerprint; it identifies an install, nothing about you or

your machine.

  • clientTag — a constant string identifying the extension.
  • licenseKey — only if/when you enter one. Absent during the free beta.

What Asheo NEVER sends

  • Card numbers (PANs), BINs, CVVs, expiries, or any generated card data.
  • Gateway URLs, request bodies, page contents, or anything intercepted.
  • Browsing history, cookies, or any identifier beyond what you explicitly type.

Update checks

The update check is an unauthenticated GET to the update feed (/v1/version).

It returns a version manifest only and sends none of your data. Update

notifications are advisory — Asheo never downloads or installs anything

automatically; it only points you to a build you choose to download yourself.

Entitlement verification

The premium entitlement returned by the server is a signed token verified locally

against an embedded public key. If the server is unreachable, Asheo uses a cached

token within a grace window and otherwise falls back to its built-in defaults — it

never blocks you out over a network failure.

Server-side logging

The server records request counts per install/IP for rate limiting only. Request

bodies are not persisted.

Self-hosting / override

You can point the update feed at your own URL (Advanced → "Update feed URL"). If

you run the whole server yourself, generate your own keys per the deployment

runbook in server/README.md.