Privacy Policy

Effective September 25, 2026. This policy covers the ThreatWing marketing website, Decompiler console, and pre-release ThreatWing Tools iOS app. ThreatWing is a separately marketed KernelHawk tool set. Product behavior, website delivery, and KernelHawk services are described separately below.

Current short version: the marketing pages have no account, upload form, advertising, or analytics code. The Decompiler console uses your existing beta API key to submit authorized files and retrieve private jobs and reports; it does not save that key in browser storage. Build 63 is the first cloud-enabled TestFlight candidate and offers Sign in with Apple as an optional feature. Connection profiles and secrets remain on your device; the optional account service uses only the account data described below. The app does not operate advertising, crash reporting, or developer analytics.

1. ThreatWing website

The static marketing pages do not create accounts, accept uploads or payments, set application cookies, or include advertising or analytics scripts. The separate Decompiler console at /decompiler requires JavaScript and existing beta access; its data handling is described in section 3. Its menu works without JavaScript; Cloudflare may provide security challenges. Cloudflare delivers and protects the site and may process network and request metadata—such as IP address, time, requested URL, user agent, and security signals—under its own service terms. ThreatWing does not receive a marketing-analytics feed from the current site configuration.

Following a link to KernelHawk is ordinary web navigation. It does not transfer a ThreatWing session or customer record. Information submitted on a KernelHawk page is governed by the notice shown on that KernelHawk surface.

2. ThreatWing Tools app

Information kept on your device

The app stores settings, connection profiles, saved-network snapshots, host-trust decisions, feature activity, locally imported files, and generated exports in its app container. Supported SSH credentials, private keys, WireGuard private keys, and proxy credentials are stored in Apple Keychain. The app does not store App Store account credentials, payment-card information, or signed StoreKit transaction payloads.

If you enable Wi-Fi identity matching, the app reads the current Wi-Fi name and router identifier to compare the network with a saved snapshot. Location permission is requested only because Apple gates that chosen Wi-Fi identity feature behind location access. Those values stay on your device unless you include them in an export.

Network actions you initiate

The app contacts a destination only when you choose discovery, a connection, diagnostic, Safety Check, provider action, or another network-tool action. It sends the destination, protocol messages, and credentials or keys needed for that selected action. Operators of destinations you choose may log or retain traffic under their own policies.

AI and handoff modes

Offline: deterministic templates and supported on-device processing do not send prompts to a developer service.
Private API: a backend you control may send the material you approve to its configured AI provider. Its operator and provider policies apply.
ChatGPT handoff: the app prepares privacy-filtered text for a copy/share action that you control. Data is not sent until you choose the destination; the destination’s policy then applies.

Generated commands are never automatically executed. The app displays the command and its risks for you to review and confirm.

Purchases

Subscriptions and any introductory offer are processed by Apple through StoreKit. ThreatWing Tools does not receive your App Store password or payment-card details. The app keeps a non-secret local display record of its last verified access state; that record cannot grant access by itself. Subscription cancellation and refund handling occur through Apple.

Optional cloud account and Sign in with Apple

Build 63 is the first candidate that enables the optional ThreatWing cloud account. You may choose Sign in with Apple through identity.threatwing.com. The service receives and stores Apple's account-specific subject identifier, a derived ThreatWing account ID, team membership and role, and the identifiers needed to authenticate enrolled devices and passkeys. It does not request or use your Apple name or email address as a ThreatWing account key.

The service stores a ThreatWing-assigned device ID, the device public key, passkey credential ID and public key, supported passkey transports, sign counter, session and revocation generations, and bounded security events. Passkey private keys remain with your authenticator. Apple access and refresh tokens are encrypted so ThreatWing can maintain the sign-in relationship and revoke it when you delete the account.

Team administrators can see member roles, Apple's account-specific subject identifiers, and enrolled device IDs and their owners. They do not receive Apple passwords, passkey private keys, or local connection profiles. ThreatWing uses these records only for sign-in, team access, session renewal, enrollment and revocation, passkeys, recovery, account deletion, and protection against replay or rollback. It does not sell this information, use it for advertising, or combine it with third-party data to track you across apps or websites.

The identity gateway briefly uses a source network prefix in memory for abuse limits. It does not write peer addresses, request bodies, authorization headers, or raw TLS errors to its application log. Cloudflare delivers and protects the public endpoint. Cloudflare Security Analytics can retain sampled request records containing source IP, time, host, method, path and query, user-agent and device properties, connection characteristics, response status, and derived security signals. These records are used for delivery, abuse prevention, and service security.

Active account, membership, device, passkey, and encrypted provider-token records remain while the account or related feature is active. Short-lived authorization challenges and replay records expire automatically. Security-only deletion, revocation, and passkey records and recoverable backup copies are retained for no more than 37 days unless a longer legal hold is required. A pending Apple revocation remains until Apple acknowledges it. Cloudflare states that Security Analytics on the current Free plan retains historical request data for up to seven days. Cloudflare account audit logs record administrator configuration activity rather than in-app activity and are retained for 18 months. No Logpush job or Worker route is configured for the ThreatWing zone.

Imports, exports, and sharing

Imports and exports occur only after you select a file or destination. Portable profile exports exclude credentials, private keys, Keychain identifiers, host-trust decisions, saved Safety Check history, and activity. Diagnostic and Safety Check reports can still contain hostnames, addresses, paths, hashes, or artifact details; inspect them before sharing.

Retention and deletion

Local information is kept until you edit or delete it, use Settings → Subscription & Data → Delete Local Connection Data, or remove the app. Delete Local Connection Data removes profiles, SSH credentials, host-trust records, saved scans, Safety Check findings, tool history, and proxy profiles and credentials. If any item cannot be confirmed deleted, the app tells you. It cannot recall files you previously exported or shared. Deleting local data does not cancel an App Store subscription or delete a separate cloud account.

If you create a cloud account, use Settings → Account & Team → Delete Account to remove your membership, enrolled devices, active sessions, pending device sign-ins, and active passkeys and to start revocation of the retained Apple authorization. Transfer administration first if deletion would otherwise leave a team without an administrator. Security-only digests and revoked credential metadata remain for the 37-day recovery period so restoring a backup cannot reactivate the deleted account. Deleting the app alone does not delete the cloud account.

App Store privacy statement

“Data Not Collected” described the local-only configuration in build 62; it does not describe build 63. The current App Store privacy response discloses linked User ID, linked Device ID, linked Product Interaction, and linked Other Data Types for app functionality. Those data types are not used for tracking. The app is not yet on the App Store.

TestFlight beta testing

If you accept a TestFlight invitation, Apple collects crash logs and usage data and shares them with the app provider. Feedback you choose to submit may also include personal information. See Apple’s TestFlight terms. This beta-testing collection is separate from the intended App Store configuration described above.

3. ThreatWing Decompiler

The Decompiler console sends your API key, selected file, filename, SHA-256, and selected profile to the existing beta processing service only when you request an action. The key is held in page memory and cleared on reload or when you select Clear key and workspace; it is not saved in browser storage or placed in a URL. The service stores inputs, job information, usage records, and generated reports for authorized tenant access and service operation. Moving the console to ThreatWing does not copy or migrate those stores or change processing approval.

Read Before you upload and confirm the applicable beta processing terms before submitting. Retention, deletion, subprocessors, and confidential-data handling must be confirmed in those terms; contact privacy@threatwing.com before submitting if they are unclear. The console does not provide self-service deletion. Marketing pages and support email do not accept binaries.

4. Your choices

Deny Local Network or location permission in iOS Settings; the related optional feature will be unavailable.
Delete individual profiles, keys, histories, or all local connection data inside the app.
Do not use share/export or third-party AI handoffs when the material is sensitive.
Manage or cancel an App Store subscription through Apple.
For a privacy question about information you sent to support, use the email address below.

5. Children

ThreatWing security tools are intended for professional and authorized technical use and are not directed to children under 13. The current site does not knowingly solicit personal information from children.

6. Security and changes

No system can guarantee absolute security. See the security reporting policy. Material changes to data handling will receive a new version and effective date before the changed processing begins where required.

7. Contact

Email privacy@threatwing.com (or use https://kernelhawk.com/contact with subject “ThreatWing privacy”). ThreatWing is operated by an individual proprietor in the United States; the legal operating entity will be published when incorporated. Do not include passwords, private keys, access tokens, proprietary binaries, or live exploit details in an initial message.