Your network data never leaves your machine
NetVane is a program you download and run yourself. There is no cloud, no account, and no server on the other end — because there is no other end. Everything it discovers about your network stays on your device.
Our privacy commitments
These aren't policy promises you have to take on faith — they follow from how the app is built. NetVane runs entirely on your machine and serves its dashboard to your own browser at 127.0.0.1:8787.
No cloud, no account
NetVane isn't a SaaS. You run it locally — no server we operate, no sign-up, no login, no email. Download, double-click, scan.
No telemetry, no ads, no trackers
No usage statistics, no metrics phoned home, no advertising, no third-party pixels or SDKs. It doesn't track how or whether you use it.
No web assets fetched
The dashboard pulls nothing from the internet — not fonts, not scripts, not CDNs. Inter and JetBrains Mono are self-hosted; vis-network is vendored.
Everything on your device
Discovery, scoring, fixes, reports, and history are all computed and stored locally. Your machine does the work and keeps the results.
Don't take our word for it — verify it
Most tools ask you to trust a privacy policy. NetVane is built so you can check the claim yourself, live, while you use it.
A live ledger of every outbound request
The Overview's Local‑only card counts and lists, in plain language, every request the app has made off your machine this session — which is normally zero. Trigger an opt‑in check (an update check, a speed test, a DNS benchmark) and you'll see exactly that request appear, named, in the ledger. Nothing can leave quietly.
Watch it with your own tools
Because there's no cloud half, the claim is falsifiable with tools we don't control: point your firewall, router logs, or a packet capture at the machine running NetVane and watch a scan — you'll see local‑network traffic only. We designed the app so this test is boring.
What data NetVane stores, and where
NetVane keeps its data in a single local SQLite database — netvane.db — sitting on your own disk. With the recommended installer it lives in %LocalAppData%\NetVane; the portable build instead keeps it in a NetVane-Data folder beside the exe, so a portable copy stays entirely self-contained. It holds your scan results, device inventory, observations, and change events, so you get history and trends across scans. None of it is uploaded anywhere.
| Data type | Where it lives | Leaves your machine? |
|---|---|---|
| Scan results | Local SQLite (netvane.db) | No |
| Device inventory | Local SQLite (netvane.db) | No |
| Observations & exposures | Local SQLite (netvane.db) | No |
| Change events & timeline | Local SQLite (netvane.db) | No |
| Security-score history | Local SQLite (netvane.db) | No |
| Settings & accepted-risk notes | Local SQLite (netvane.db) | No |
| Exported reports & CSVs | Files you save on your disk | No |
The database is a normal SQLite file (WAL mode) — a few megabytes that grows slowly with your scan history. It's yours: back it up, move it, or delete it whenever you like.
How long your history is kept
NetVane keeps your history for a long time, but not forever — a database that only ever grew would eventually become a problem on your disk. The window is deliberately generous, and it is decided entirely on your own machine.
Six months, or your last 120 scans — whichever is more, and you can change both
Everything from the last 180 days (about six months) is kept. On top of that, your 120 most recent scans — and the device detail and changes recorded with them — are kept however old they are. A scan is removed only once it is both older than six months and outside those 120, so the more generous of the two always wins: scanning weekly that's over two years of history, scanning monthly a decade, scanning several times a day a full six months. Alerts and notices that don't belong to a scan simply age out after six months.
Those two figures are the defaults, and both are yours to change in Settings → Data & backup — keep less if you want a smaller database, or more if you want deeper history. Lowering them never deletes history you already have: every scan keeps the window it was recorded under, so a smaller setting only affects what is kept from that point on. Nothing NetVane does, and nothing about your licence, can reach back and remove your existing records.
Your inventory is never removed
Your device list, the labels and notes you write, the risks you've accepted, and your settings stay until you delete them. Only the scan-by-scan detail behind them ages out. Separately, a few live charts keep a short window on purpose, because a short window is all they're for: router-response samples cover the last 7 days, data-volume samples the last 14 days, and the speed test keeps your last 50 results.
netvane.db somewhere safe while the app is closed.
What NetVane sends, and where
Nothing about your network ever leaves your machine except things you explicitly trigger. Here is every kind of outbound traffic NetVane can generate — complete, including the two that carry any data, both of which exist only if you act. Every one of them is recorded in the in-app Local-only ledger.
1 · Activity on your own network
NetVane's probing stays on your local network — never sent to us or anyone else. Alongside TCP-connect probes, ARP-table reads, reverse-DNS and banner grabs, it can (to identify devices and check your exposure) do a read-only SSDP/UPnP sweep, a single broadcast DHCP-discovery to spot rogue DHCP servers (it never takes a lease), a UPnP-IGD query to your own router for its port-forwards, and — only when you click it — a Wake-on-LAN packet to a device you choose. All of it is confined to your LAN.
2 · The two sends you can trigger yourself
A change-alert webhook: if — and only if — you configure one, NetVane POSTs a change alert to the URL you choose. Leave it unset and no such request is ever made. A support report: if you open Report a problem, tick the consent checkbox, and click send, NetVane emails your report — with recent app logs redacted of device IPs and MAC addresses — to our support inbox. It only ever happens on that explicit click, and it shows up in the Local-only ledger like everything else.
netvane.doorvane.com "is there anything newer?" — plus an internet speed test (Cloudflare's public endpoint) and a DNS speed benchmark (one test query, for a fixed benign name, to each resolver being timed). None sends any information about your network. There is no telemetry and no analytics of any kind.
How to delete your data
Because everything lives in local files, cleanup is completely in your hands — no account to close, no server-side data to request deletion of.
- 1Stop the app. Close NetVane so nothing is writing to the database.
- 2Delete
netvane.db(and its-wal/-shmsidecar files, if present). If you used the installer, it is in%LocalAppData%\NetVane— paste that into the Explorer address bar. If you run the portable build, it is in theNetVane-Datafolder next toNetVane-Portable.exe. - 3Delete any reports or CSV exports you saved elsewhere.
That's it. Removing the database wipes your entire scan history; removing NetVane.exe removes the app itself.
Security of the app itself
Local and private also means restrained. NetVane validates your network's real exposures without becoming a risk of its own — it never exploits or alters devices.
Binds to localhost only
The dashboard listens on 127.0.0.1:8787 — reachable only from your own machine, not exposed to the rest of the network.
Non-destructive toward other devices
NetVane never exploits or changes other devices, and never logs into hosts. By default it does run non-destructive active validation — protocol probes that confirm which exposures are real versus already secured — and an optional authenticated depth can try default or blank credentials for authorized testing only. Even the "Aggressive" profile just scans harder; it never attacks.
Runs without admin rights
The built-in engine uses unprivileged TCP and ARP — no raw packets, no drivers (Npcap/WinPcap not required), no elevated privileges.
Signed, so you can check who built it
The download is Authenticode-signed as GRCSAC. Right-click NetVane.exe → Properties → Digital Signatures to confirm the file is exactly what we published and has not been altered on its way to you.
Responsible & authorised use
NetVane is a defensive inventory and monitoring tool. Use it to understand and secure networks you're responsible for.
These commitments are structural
NetVane keeps your data private not because a policy says so, but because the only outbound traffic that ever carries data about your network is a webhook you configure yourself, or a support report you deliberately send. The privacy is built in, not bolted on.
Repo access required · the source is not public.