Privacy Policy (beta)

Last updated 25 August 2026. Written to be read by a person, not a lawyer. The product's behaviour is the source of truth and this page follows it, never the other way round.

Who we are. SmithyForge LTD (UK), the maker of Digital Defender. Contact: support@smithyforge.com.

What the beta sends, and when

Digital Defender includes cloud-assisted protection, which is on by default and which you can turn off — during install (untick "Cloud-assisted protection" on the components screen) or at any time afterwards. When it is on, the service sends one short report per day, and only if something happened worth reporting.

A report contains:

• Counts — how many programs were examined, how many were trusted by their publisher signature, how many were scored by the local model, and how many the model would have blocked or flagged.
• For the programs it would have blocked or flagged only — the file path (with your Windows user name removed), the file's SHA-256 hash, its size, its score, and its publisher name if it had one.

That is the whole of it.

The weekly scan

Once a week, around 3am, Digital Defender examines the programs installed on this PC with the same engine that protects it — quietly, at low priority. You can untick "Weekly scan" at install, or remove the "Digital Defender scan" task in Task Scheduler at any time.

The scan's full results stay on this PC, in C:\ProgramData\DigitalDefender\scans\ — open them whenever you like.

If cloud-assisted protection is on, the scan also sends one report: the same counts and flagged-file details described above, plus statistical measurements of programs that do not carry a valid publisher signature. Each is identified by its SHA-256 fingerprint — no file name, no path — with number distributions (sizes, byte statistics, header fields) that cannot reconstruct the file or its contents. Unsigned software is exactly what the detection model is most unsure about, and these measurements are how it learns to stop flagging the legitimate kind. If cloud-assisted protection is off, the scan runs and its results stay local — nothing is sent.

What it never sends

• The contents of any file. Ever.
• An inventory of your software. The daily report only ever describes the handful of programs the model was unsure about — never the ones it allowed. The weekly scan's one, disclosed exception is above: fingerprints and measurements of unsigned programs, never signed software, never file names or contents. What is on your machine is yours, not ours.
• Your Windows user name. Paths are redacted before they leave: a path like C:\Users\yourname\Downloads\x.exe is sent as C:\Users\<user>\Downloads\x.exe.

You can read exactly what left your machine

Every report is written to C:\ProgramData\DigitalDefender\reports\ before it is sent, and kept there afterwards. The file on disk is byte-for-byte what was sent. You can open it, keep it, or delete it. Nothing is sent that is not in one of those files.

Why we collect it

To find false positives early — cases where the model flags a legitimate program — and to improve detection. A background service on a stranger's machine is exactly where "trust us" is worth the least, so the design makes the data checkable rather than asking for trust.

Under UK GDPR our lawful basis is legitimate interests: running and improving a security product. You can object by turning cloud-assisted protection off, which stops all sending immediately.

What we do with it

The reports go to SmithyForge's own endpoint. We use them to investigate false positives and to build training data for future model versions. We do not sell them, and we do not share them with third parties for advertising. Reports are retained while they are useful for that purpose and then deleted.

The machine name

A report includes the machine's Windows computer name, so we can tell one beta machine's reports from another's over time. If you would rather it did not, turn cloud-assisted protection off.

Turning it off

• During install: untick "Cloud-assisted protection" on the components screen.
• After install: click the Digital Defender shield in the system tray and untick Cloud-assisted protection. Windows will ask you to approve the change. Sending stops immediately, and nothing is queued up for later.

Automatic updates

The service checks once a day for a newer version and installs it if one is available, so fixes reach you without a re-download. The check is a request to our download server for a small version file; it carries no information about you beyond what any web request does (your IP address, as your network already sees). An update is installed only if it is digitally signed by SmithyForge LTD — a tampered or fake update is refused. To turn automatic updates off, set "auto_update": false in C:\ProgramData\DigitalDefender\settings.json (a one-click switch in the tray is coming in a beta update).

Changes

If this policy changes in a way that affects what is collected, the change lands in the product and its installer at the same time — the installer's disclosure screen and this page always describe the same behaviour.