Privacy Policy — ScarCore
Effective date: August 8, 2026
Last updated: August 8, 2026
Product: ScarCore 3D asset manager desktop application
Operator / website: Redscar (https://redscar.net)
This Privacy Policy describes how ScarCore (“ScarCore,” “we,” “us,” or “our”) handles information when you use the ScarCore desktop application and related product pages on redscar.net (for example, download and update hosting).
ScarCore is designed as a local-first desktop product. Core library features work on your computer without creating a ScarCore user account. Most of your content and catalog never leave your device unless you connect optional third-party services or enable optional features that call the internet.
1. Summary
| Topic | How ScarCore handles it |
|---|---|
| ScarCore account | Not required for the desktop app’s core library features |
| Your asset files & catalog | Stored on your machine (local SQLite database, settings, thumbnails, library folders) |
| Product analytics / advertising trackers | Not used in the desktop app (no ad SDKs, no behavioral analytics product) |
| Optional third-party logins & API keys | Stored locally; used only to talk to providers you enable |
| Network calls we initiate | Optional auto-update checks/downloads against redscar.net (when enabled) |
| Who can read your library | You control access; optional local MCP access can be turned off in Settings |
This summary is for convenience. The sections below are controlling.
2. Who this policy covers
This policy applies to:
- ScarCore desktop application (Windows; Linux where offered) — Tauri-based client identified as
com.scarcore.desktop. - Product distribution endpoints on redscar.net used for ScarCore installers and update manifests (for example,
https://redscar.net/apps/scarcore/and related download pages).
It does not control the privacy practices of third-party sites or APIs you choose to connect (OpenAI, Anthropic, Google, Dropbox, Amazon S3 / compatible storage, Unity, Fab, custom LLM endpoints, etc.). Those services have their own policies.
3. Information we do not collect as ScarCore (desktop)
As of the effective date, the ScarCore desktop application does not:
- Require registration of a ScarCore username/password for core catalog features
- Operate a ScarCore cloud account that stores your library for us
- Ship advertising SDKs or sell access to your library contents
- Continuously upload your asset files, tags, descriptions, previews, or search history to ScarCore servers for product analytics
- Send your third-party API keys, cloud passwords, or marketplace session cookies to ScarCore servers
Logs stay local. Application log messages are written for local diagnostics
4. Information processed on your device
ScarCore processes and stores data locally under a portable application data area next to the program (commonly an app_data folder alongside the executable), including:
4.1 Asset library catalog
- Asset records (paths, types, status, technical metadata)
- Tags, descriptions, favorites, collections
- Thumbnails and preview caches
- Import/export history as needed for features
- Optional embedding / AI search indexes and related local ML artifacts when you use those features
Your original media files live where you put them (library folders, reference paths, marketplace downloads, etc.). ScarCore indexes and previews them; it does not require uploading those files to us.
4.2 Application settings
Preferences such as library paths, UI options, export presets, battery/data-saver modes, auto-tag provider choice, marketplace toggles, update cadence, and integration paths (for example Unity Editor paths). Settings are saved in a local settings.json file.
4.3 Optional credentials you supply (local)
Depending on features you enable, ScarCore may store on your device:
| Credential type | Typical purpose | How ScarCore stores it |
|---|---|---|
| LLM / auto-tag API keys (OpenAI-compatible, Anthropic, custom endpoint keys) | Optional AI tagging via providers you choose | Saved in local settings (settings.json) with the auto-tag configuration |
| CGTrader API / OAuth access token | Marketplace import when you paste a key | Saved in local settings under marketplace settings |
| Marketplace browser sessions (Unity Asset Store, Fab) | Import of your purchases after you log in in an in-app window | Session cookies saved as local JSON files under app data (marketplace/cookies/…) |
| Cloud library connections (Google Drive, Dropbox, S3 / S3-compatible) | List remote libraries, fetch files for previews, write ScarCore preview cache folders on the remote | Secrets stored as encrypted ciphertext in the local database; encryption master key kept in the OS credential store when available (Windows Credential Manager / platform equivalent), with a local file-key fallback if the OS store is unavailable |
| OAuth refresh tokens (Google Drive, Dropbox) | Renew access without re-login | Prefer storing refresh tokens only (short-lived access tokens obtained as needed; not persisted when a refresh token exists) |
| S3 access key + secret | S3-compatible cloud roots | Sealed with the same local cloud encryption scheme |
Important: ScarCore does not implement a separate ScarCore “login password” for the desktop product. Access control for local files follows your operating system user account and filesystem permissions.
4.4 Local-only diagnostics
Debug/log output can include operational details about imports, network errors from third parties, and feature status. Cloud/API error handling is designed to redact common secret fields (for example tokens and passwords) before showing provider error bodies in logs or UI messages. No system is perfect—avoid pasting secrets into free-text fields that are not password/key inputs.
5. How we handle third-party credentials and logins
5.1 General principles
- You opt in. Marketplace, cloud, and cloud LLM features are optional.
- Credentials stay local by default. Keys, cookies, and tokens are stored on your machine for the app to call the third party directly.
- We are not your identity provider. When you log into Unity, Fab, Google, Dropbox, etc., you authenticate with those companies.
- Least privilege where the product can choose. For example, Google Drive OAuth is scoped to Drive file access patterns the app needs; Dropbox scopes are limited to account info and file metadata/content read/write used by the connector.
- You can disconnect. Marketplace logout clears local session files for that source; cloud connections can be removed; API keys can be cleared from settings; disabling auto-tag / marketplace sources stops further use.
5.2 Marketplace logins (Unity, Fab)
- Unity / Fab: ScarCore opens a dedicated login window so you can sign in on the store’s website. After you confirm login, ScarCore captures the resulting session cookies and stores them locally to make authenticated requests on your behalf (for example, listing purchases you already own).
- Purpose of network traffic: talking to the marketplace domains to sync purchase metadata and download assets you select—not to send those credentials to ScarCore servers.
- Risk note: Cookie files and settings keys are powerful. Anyone with full access to your user account and app data folder can use them. Protect your machine login, disk encryption, backups, and shared-PC scenarios accordingly. Log out of marketplace sessions you no longer need.
5.3 Cloud connectors (Google Drive, Dropbox, S3)
- OAuth (Google / Dropbox): Uses industry-standard desktop OAuth patterns (including PKCE and a localhost loopback callback). App client identifiers may ship with the product; client secrets for production desktop builds are not required when PKCE is used.
- At rest: Cloud secrets are encrypted with AES-256-GCM. The master key is preferably held in the OS credential store (
com.scarcore.desktop). - In transit: HTTPS to the provider.
- In memory: Sensitive values are handled carefully (including zeroizing patterns where implemented).
- What may be written remotely: When generating previews for cloud-backed assets, ScarCore may upload preview/cache material under a dedicated remote library data folder (for example a
ScarCore-LibData-style path) so other machines you control can reuse previews—not so ScarCore’s operator can browse your library. - Restore caveat: Moving only a database file to a new machine typically does not restore usable cloud passwords/tokens, because the encryption master key lives with the original OS user/keyring. You re-authenticate.
5.4 AI tagging API keys (OpenAI, Anthropic, custom URL)
- Stored in local settings when you enter them.
- Used only to call the provider and model you configure.
- If auto-tagging is enabled, preview media or content derived from your assets (for example images, multi-angle model previews, short audio clips) may be sent to that provider so tags/descriptions can be generated.
- Local provider option: You can use a local vision/LLM setup (llama.cpp-style pack) so tagging stays on-device when configured that way.
- Your responsibility: Review the privacy and data-retention policies of any cloud AI provider you enable. ScarCore does not control how those providers store prompts, images, or logs.
5.5 What backups include (and exclude)
Library catalog backups (.scbackup) are designed to include catalog database content, settings, and thumbnails (optionally addons). They are not a full dump of every original asset file.
Practically:
- Settings in a backup may include values you put in
settings.json(including optional LLM / CGTrader keys if present). Treat backup files as sensitive. - Cloud connection ciphertext may exist inside a backed-up database, but decrypting it generally still requires the local master key / OS keyring context.
- Marketplace cookie files and OS keyring master keys are not the same as a complete portable “login pack”; plan re-login after major migrations.
- Manifest notes state that original asset files and secrets are not the focus of the archive; still, handle backups securely because settings and catalog metadata can be confidential.
6. Network activity and information that may reach our systems
6.1 Software updates (redscar.net)
When update checking is enabled (user cadence; can be set to never), ScarCore may contact:
- Update manifest:
https://redscar.net/apps/scarcore/latest.json - Installer / artifact URLs hosted on redscar.net (host pinning and signature verification are used so updates are constrained to expected infrastructure)
Typical technical data associated with any HTTPS download (as processed by hosting/CDN/server logs) can include IP address, user agent, timestamps, requested URL, and success/failure status. That is ordinary web server logging for distribution security and reliability—not a profile of your asset library.
You can reduce this contact by setting update frequency to never and installing updates manually from the download page.
6.2 Product website pages
If you browse redscar.net product pages in a browser, standard website/server practices may apply (server logs, cookies if the site sets them). This policy’s desktop sections govern the application; website cookie banners or site-specific notices, if any, may provide additional detail for pure web browsing.
6.3 What we do not receive from optional third parties by default
When you connect Google, Dropbox, marketplaces, or LLM APIs, those requests go from your device to that third party. ScarCore’s operator does not sit in the middle of those sessions as a proxy for your library content under the current architecture.
7. Optional local integrations (MCP and addons)
7.1 MCP server access
ScarCore can allow an external local MCP client (scarcore-mcp and similar tools) to read catalog information for agent workflows. Access is controlled by a local setting (“Allow MCP server access”). When disabled, external MCP clients are expected to refuse catalog access. This does not send your catalog to ScarCore servers; it governs local machine integrations you install.
7.2 WASM addons
Addons can request capabilities (file scope, network hosts, etc.). You should only install addons you trust. Safe Mode can restart the app with addons deactivated if an addon misbehaves.
8. Children’s privacy
ScarCore is a professional / creative-production tool and is not directed to children under 13 (or the equivalent minimum age in your jurisdiction). We do not knowingly collect personal information from children through the desktop app. If you believe a child has provided personal information to us via our website, contact us and we will take appropriate steps.
9. Legal bases (EEA/UK where applicable)
Where GDPR/UK GDPR applies and we act as a controller for limited website/update-distribution data, we typically rely on:
- Legitimate interests — secure software distribution, fraud/abuse prevention on download endpoints, product improvement of hosting reliability
- Contract / requested service — delivering the software and updates you request
- Consent — where required for non-essential website cookies (if used)
For data processed only on your device under your control, you are generally the party determining purposes for your library and third-party connections.
10. Data retention
| Data | Retention |
|---|---|
| Local library, settings, credentials, cookies | Until you delete them, uninstall/remove app data, log out, or clear keys |
| Update/download server logs on redscar.net | Retained only as long as needed for security, abuse prevention, and operational purposes (then deleted or aggregated) |
| Support emails you send us | Retained as needed to respond and for legitimate business records |
Uninstalling the application may not automatically wipe a portable app_data folder if it remains on disk—remove it manually if you want local data destroyed.
11. Security measures
We design ScarCore with local-first security practices, including:
- Local SQLite catalog and portable app data layout
- Encrypted at-rest storage for cloud connector secrets (AES-256-GCM + OS keyring master key when available)
- OAuth PKCE / loopback patterns for cloud desktop auth
- Redaction of common secret fields in provider error messages
- Update package signature verification and TLS host constraints for redscar.net update traffic
- UI password-style fields for API keys
No method of electronic storage or transmission is 100% secure. Protect OS user accounts, use full-disk encryption, limit who can access your machine, and treat API keys, marketplace sessions, and backups as confidential.
12. Your choices and rights
Depending on your location, you may have rights to access, correct, delete, or restrict certain personal data we hold, or to object to certain processing. For desktop local data, you exercise control directly:
- Edit or delete assets, tags, and collections in the app
- Clear API keys in Settings
- Log out of marketplaces / remove cloud connections
- Turn off auto-tagging, marketplace sources, MCP access, or automatic updates
- Delete the app data directory and backups you created
For personal data you sent us via email or that appears in website/server logs, contact us using the details below. We may need enough information to verify the request.
13. International transfers
If you use third-party AI, cloud storage, or marketplace services, your data may be processed in countries where those providers operate. Review each provider’s terms. Update/download hosting for ScarCore may involve infrastructure that processes connection metadata in the regions where redscar.net is hosted or fronted.
14. Third-party services (non-exhaustive)
If you enable them, the following categories of third parties may receive data from your device:
| Category | Examples | Data that may be sent |
|---|---|---|
| AI providers | OpenAI, Anthropic, user-specified OpenAI-compatible endpoints | API key (as auth), prompts, images/audio derived from assets for tagging |
| Cloud storage | Google Drive, Dropbox, Amazon S3 / B2 / R2 / MinIO, etc. | OAuth tokens or access keys; file list/metadata; file bytes for preview; optional preview cache uploads under ScarCore library data paths |
| Marketplaces | Unity, Fab, CGTrader | Session cookies or API tokens; purchase list/metadata; package downloads you initiate |
| Update host | redscar.net | Version check and installer download requests |
Always review the privacy policy of each service you connect.
15. Changes to this policy
We may update this Privacy Policy as the product evolves (for example, if paid licensing validation, customer portals, or optional telemetry are introduced). Material changes will be reflected by updating the “Last updated” date on this page and, where appropriate, a notice on the product website or release notes. Continued use after an update means you accept the revised policy to the extent permitted by law.
If a future version of ScarCore introduces online license activation or account features, we will describe what device or entitlement data is sent, why, and how long it is kept.
16. Contact
Questions about this Privacy Policy or ScarCore privacy practices:
- Website: https://redscar.net
- Product / downloads: https://redscar.net/tools/3d-asset-management
For privacy requests, include “ScarCore Privacy” in the subject line and enough detail for us to respond (for example, whether your question concerns the desktop app, website, or a specific feature).
17. Plain-language FAQ
Does ScarCore upload my entire asset library to the cloud?
No. The catalog is local. Cloud features only talk to your connected storage or marketplaces when you use those features.
Do you sell my data?
No.
Where are my API keys stored?
On your computer (settings and/or encrypted cloud credential storage). They are used to authenticate you to the third party you configured—not as a ScarCore login.
Can ScarCore staff see my Google Drive / Dropbox / S3 files?
Not through normal product operation. Connections are device-to-provider. Protect your machine and backups.
Is marketplace login password stored by ScarCore?
ScarCore does not ask you to type your Unity/Fab password into a custom form for storage; you log in on the store site, and ScarCore stores the resulting session cookies locally (or a CGTrader token you paste). Those sessions are equivalent to being signed in—treat them as secrets.
What if I use local AI only?
Configure auto-tagging to the local provider and keep marketplace/cloud features disconnected. Core organization features remain offline-capable aside from optional updates.
This document is provided for product transparency and website publication. It is not legal advice. If you need jurisdiction-specific counsel (GDPR DPA, CCPA “Do Not Sell,” etc.), have qualified counsel review before relying on it in regulated contexts.