# PRIVACY.md

# BUS Core Privacy Statement

Last updated: August 3, 2026

BUS Core is designed to run locally on your machine.
Because of this architecture, operational business records remain under the operator's control.

---

## Local Operation

All operational data is stored locally in a **SQLite database** on your device.

Examples include:

* inventory records
* manufacturing recipes
* cost data
* production logs
* sales records

This data is not transmitted to the developer.

---

## Current Network Signals

BUS Core can make optional version-aware update checks. Those requests may include the current app version, release channel, and whether the local profile has previously attempted a version-aware check. They do not include an installation identifier, shop records, customer data, item or recipe data, invoice contents, quantities, financial values, file paths, or machine fingerprints.

The packaged product client implements optional telemetry behind a first-run disclosure and settings control, and it sends nothing until that disclosure is acknowledged with telemetry enabled. It sends only allowlisted event names with an event ID, timestamp, app version, release channel, and coarse operating-system category; it sends no persistent installation identifier. The HTTPS request uses `User-Agent: BUS-Core/<VERSION>` to identify the product/version, not a user, device, or installation. It queues at most 100 events, retries at most three times, and completes an event or one-time milestone only after Lighthouse acknowledges the exact event ID. Rejected or retry-exhausted events remain in a bounded local dead-letter file, and unsupported older-server responses do not affect local work. Turning telemetry off clears the unsent queue.

The payload constructor cannot accept customer, supplier, employee, item, recipe, invoice, email, document, filepath, financial, quantity, raw database, username, hardware, or machine-fingerprint content. Signals are limited to first launch, once-per-version release adoption, startup/manual update checks, successful update staging, reliability, and one-time successful use of major product areas. Module opens, active days, sessions, returning installations, engagement, and retention are not reported. Lighthouse migration 0015 and Worker 1.27.0 are deployed and production-verified.

---

## No Hosted Account Required

BUS Core Self-Managed does not require a hosted account, cloud service, or subscription. A local instance can remain unclaimed, or an operator can configure local users and permissions; those local accounts do not create a TGC-hosted account.

The software can run completely offline when optional network features, including update checks, are disabled. TGC Managed BUS is an upcoming optional service in which TGC would operate an isolated deployment for the customer. It is not generally available in the current release.

---

## Local Web Interface

BUS Core runs a local web interface normally available at:

```
http://localhost:8765
```

This interface is accessible **only from your device by default**, unless you intentionally configure your system to expose it to a network.

---

## Optional Update Checks

If enabled, the software may check the public BUS Core release service for new releases.

These requests do not include operational business data or a persistent client identifier.

Update checks can be disabled.

---

## Data Ownership

You control the data stored in BUS Core Self-Managed and can export it.

In the current self-managed product, TGC does not host or control your database.

Because the system runs locally, the developer cannot recover lost data.

Self-managed operators are responsible for maintaining backups. The upcoming Managed BUS service is intended to add managed backups, recovery, export, and offboarding around the same BUS Core product without creating a divergent fork.
