darkmoon — Privacy Policy
Last updated: 18 September 2026
The short version
darkmoon runs on your computer. Your photographs, your edits, your catalogue and your presets stay there. We do not collect them, we do not see them, and we have no server for them to go to.
There is no account to make, no analytics, no crash reporting and no usage tracking.
Three things do leave your machine, and sections 3, 5 and 6 say exactly what each one sends. Cloud AI sends an image, and only when you turn it on yourself. A licence check sends your licence key when darkmoon starts and once an hour while it is open, and nothing else — no photograph, no filename, nothing about what you edit. An update check asks the website which version is the newest and sends nothing at all; you can switch it off.
1. Who we are
Vinicius Oliveira, the author of darkmoon. Contact: vinioliveiras667@gmail.com.
2. What stays on your computer
Everything the application produces lives on your own disk, under your
documents folder, in darkmoon/:
| What | Where |
|---|---|
| The catalogue of folders and photographs you have opened | darkmoon_catalog.json |
| Your settings | darkmoon_settings.json |
| Your edits, per photograph | darkmoon_photo_curves.json, darkmoon_photo_presets.json, darkmoon_photo_meta.json |
| Masks and object removals | darkmoon_masks.json, darkmoon_inpaint.json |
| Thumbnails, previews and AI caches | darkmoon/previews/, and the AI cache folders beside it |
Your original photographs are never modified. The application reads them and writes only the files you explicitly export.
You can delete any of this at any time; the application rebuilds what it
needs. Deleting the darkmoon/ folder resets it to a fresh install.
3. Cloud AI — the one thing that sends a photograph
The AI Denoise window has a Cloud AI tab. It is off by default. To use it you have to pick a provider and paste an API key that you obtained from that provider yourself.
When you then run it on a photograph:
- the image is uploaded to the provider you chose — Topaz Labs, OpenAI or Google, depending on your selection — together with your API key, so that they can process it and return a result;
- that transfer goes directly from your computer to them. It does not pass through us, and we never receive a copy;
- what they do with the image, how long they keep it, and whether they train on it are governed by their terms and privacy policy, not by this one. Read them before sending photographs of other people.
Every other AI feature in darkmoon — denoising, upscaling, masking, colourising, object removal, generative fill — runs entirely on your own machine, on models that ship inside the application. Nothing about them touches the network.
4. Your API keys
Keys you enter are stored encrypted at rest using the Windows Data
Protection API (CryptProtectData), which ties them to your Windows
account on that machine: another account, and another computer, cannot
read them. They are sent to nobody except the provider they belong to.
You can remove a key by clearing the field in the Cloud AI tab.
5. Your licence
darkmoon is paid for by subscription, and it checks that the subscription is still running. That check is the only request the application makes on its own.
Where it goes. To Lemon Squeezy (api.lemonsqueezy.com), who sell
darkmoon and issue the licence keys. Not to us: we run no server, and we
never see the request.
What it sends. Your licence key, and a name for this computer so that you can tell your three activations apart in your own account. Nothing else. Not a photograph, not a filename, not a setting, not a word about what you edit or when.
How often. When darkmoon starts, and once an hour while it is left open. Often enough that a subscription which has ended is noticed by the application rather than discovered by you halfway through a job, and rare enough to stay one small request that carries nothing about your work.
If it cannot reach them — you are offline, they are down, a hotel network is in the way — darkmoon carries on for thirty days before anything changes, and not being able to ask is never treated as a refusal.
What is stored on your machine. Your key, the identifier of this activation and the date of the last successful check, encrypted at rest with Windows DPAPI, tied to your account on this computer. You can remove all of it from Settings, which also releases this machine's activation so you can use it on another.
Lemon Squeezy is the merchant of record for the sale. What they hold — your email address, your payment details, your invoices — is theirs and governed by their privacy policy, and the same is true of any refund or tax obligation attached to it. We never see your card, and the application never asks you for one.
6. What we collect
Nothing.
To be concrete rather than reassuring: the only code in darkmoon that opens a network connection is the Cloud AI providers described in section 3, the licence check described in section 5, and the update check described just below. There is no analytics library, no crash reporter and no telemetry, and nothing reaches a server of ours, because we do not run one.
The update check. Once, when darkmoon starts, it asks GitHub which version the website's download currently offers, and compares that number with your copy. If yours is older it says so at the top of the window and offers the page; nothing installs itself and nothing is downloaded until you go and get it. The request carries no licence key, no identifier and nothing about you or your photographs — GitHub sees what any web request shows, an IP address and a time. Turn it off with Tell me about new versions in Settings, and darkmoon never asks again. A copy installed from the Microsoft Store never asks at all, because the Store handles its updates.
The licence check is between your computer and Lemon Squeezy. We learn from it only what any shop learns: that somebody's subscription is running. We cannot tell from it which photographs you opened, or that you opened any.
7. Children
darkmoon is a photo editor for general use. It is not directed at children and we knowingly collect no data from anyone, of any age.
8. Your rights
Since we hold no personal data about you, there is nothing for us to show you, correct or delete. Data protection law — including the GDPR, where it applies — gives you rights over data a company holds about you; in our case the honest answer is that the set is empty.
For the photographs you choose to send through Cloud AI, the rights you have are against that provider, and you exercise them with that provider.
9. Changes to this policy
We may update this policy. The version that ships inside a release of darkmoon is the one that applies to that release, and the date at the top says when it was last changed.
10. Contact
Questions about this policy: vinioliveiras667@gmail.com.