Encore — Privacy Policy

Last updated: 9 October 2026

Applies to: Encore desktop application for Windows

Encore is published by Ferox, LLC, a Virginia limited liability company ("Ferox", "we", "us"), 8403 Porter Lane, Alexandria, VA 22308, USA. Questions about this policy or your data: rusty.luhring@ferox.com.

1. The short version

Encore is a desktop financial-modelling application. Your models live on your own computer or on storage you control. We do not operate any server that receives your data, and Encore contains no analytics, telemetry, tracking, advertising, or usage reporting of any kind.

Data leaves your machine in three circumstances, all optional and all off until you act:

1. The AI assistant, if you switch it on and supply your own API key. You are asked to consent before the first message is sent — separately on each screen the assistant appears on, because they send different things. Your content then goes directly to the AI provider — never through us.
2. The Google Sheets integration, if you sign in with your own Google account and run a script that uses it. Only the cell values that script chooses are sent, directly to Google — never through us. See section 3A.
3. Checking for updates, if you turn on the startup check or choose Help ▸ Check for Updates. Encore fetches one public file containing the latest version number; it sends nothing about you or your models. See section 3B.

2. What Encore stores on your computer

All of the following stays on your device or on storage you choose. None of it is sent to us.

If you use Model Share to sync a model to a folder inside OneDrive, Google Drive or Dropbox, your files are handled by that provider under their privacy policy and your agreement with them. Encore only reads and writes a folder you nominate; it holds no credentials for those storage services and never contacts them directly. (The Google Sheets integration in section 3A is separate: it holds a Google sign-in limited to Google Sheets, and only when you choose to sign in.)

3. The AI assistant

The assistant is disabled by default. It becomes active only when you enter your own API key from the AI provider and accept the in-app consent prompt.

3.1 Where the data goes

To Anthropic PBC, at api.anthropic.com, using the API key you supplied. Your use of that service is governed by Anthropic's own terms and privacy policy, and by whatever agreement your API key is issued under — including any data-retention or training-exclusion terms that come with a commercial API account. Encore is not a party to that relationship; it uses your credentials on your behalf.

We never receive this data. It goes from your computer to Anthropic directly. We operate no intermediary service.

3.2 What is sent

Only what is needed for the request you make. The assistant appears on two screens, and they send different things, so you are asked to consent separately on each.

On both screens:

• Your question and the conversation so far in that chat.
• Files you attach with the Attach button.
• The open editor file — its full path and its contents (or just your selection) — when "Include editor context" is on.
• Anything a tool the assistant runs returns to it. If a question requires it, the assistant can read file contents from the folders on its allowed list and list those directories. Files you never attached are therefore reachable if they sit under an allowed folder.

On the end-user screen, additionally:

• The structure of the open model when "Include matrix" is on: the model and file name, row and column names, matrix variable names and values, fiscal-year settings and column landmarks. This context block does not include cell figures.
• Actual cell values from your matrix, when a tool reads them to answer your question. Your financial figures can be transmitted when you ask something that needs them. They are never sent automatically or in the background.

On the developer screen, additionally:

• Your source — logic, exec, reportspec and viewspec files — via the editor context and the open-tab list.
• Compile errors and recent exec output, when those switches are on.
• The assistant can also propose writing files and running exec scripts. Every write is confirmed before it happens unless you enable auto-approve.

3.3 Financial data, expressly

Encore is used to build financial models, so the material above can constitute confidential business or financial information. We draw specific attention to this because it may be commercially sensitive, and because you may be under confidentiality obligations to clients whose figures are in a model.

You control this. You can:

• leave the assistant switched off entirely — everything else in Encore works without it;
• turn off any of the context switches (editor, matrix, errors, exec output) per conversation, so less is included;
• restrict which folders the assistant may read via Assistant → Settings → Allowed paths;
• decline any file-write the assistant proposes — each one is confirmed unless you enable auto-approve;
• delete your conversation history at any time from the assistant's history window, or by deleting the files in %LOCALAPPDATA%\EncoreNew\.

3.4 The one other request

If you press Refresh models in the assistant's settings, or in the administrator console, Encore asks Anthropic which models your API key can use. That request carries your API key and nothing else — no model data, no file contents, no message text. It happens only when you press the button.

3.5 What is not sent

Your API key is sent only to Anthropic, as the authentication header for your own requests. Encore does not transmit your models, files, licence details, machine identifiers, IP address, or usage statistics to us or to any other third party.

3A. The Google Sheets integration

Exec scripts can write model data into a Google Sheet, and read values back from one. This is off until you press Sign in in Settings ▸ Integrations (or run GSHEETSIGNIN) and approve access in Google's own consent screen.

3A.1 Where the data goes

To Google LLC: the sign-in is handled at accounts.google.com and oauth2.googleapis.com, and the data is read from or written to sheets.googleapis.com, in a spreadsheet in the Google account you signed in with (or one shared with it). Your use of Google Sheets is governed by Google's terms and privacy policy. We never receive this data; Encore talks to Google directly, using your sign-in on your behalf.

3A.2 What is sent

Only what the script sends: the cell values, row names and column names named in its GSHEET commands, and the id of the spreadsheet it opens. Nothing is sent automatically or in the background — a script must run, and the pre-run summary lists every command that reaches Google before the script starts. The sign-in asks Google for access to Google Sheets only (not Drive, Gmail or your profile).

Encore's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In practice: the spreadsheet data Encore reads or writes is used only to run the script you chose; it is never transferred to Ferox or to anyone else, is never used for advertising, and is never read by a person.

3A.3 What Encore stores

A refresh token — a long-lived credential Google issues so you do not have to sign in every time — in %LOCALAPPDATA%\EncoreNew\google.json, encrypted with Windows DPAPI for your Windows user account. Sign out in Settings ▸ Integrations revokes it at Google and deletes it; you can also revoke Encore's access at https://myaccount.google.com/permissions. The OAuth client that identifies Encore to Google — either the one built into Encore or one your administrator enters in the instance configuration — is not your credential and holds no access to your data by itself.

3B. Checking for updates

Encore can tell you when a newer version is available. This is off until you tick Check for a new version of Encore when it starts in Settings ▸ Preferences; Help ▸ Check for Updates performs the same check once, when you choose it.

3B.1 What is sent and where

A single HTTPS request for a small public file (latest.json) on Encore's release site at github.com (GitHub, Inc.), made at most once a day. Like any web request it carries your IP address and Encore's version number in the request; it carries no account identifier, licence details, model data or usage information, and nothing is stored about you on our side. An administrator can turn the check off for a machine, or point it at an internal mirror, in the instance configuration.

3B.2 Installing an update

Nothing is downloaded until you choose Download and install. The installer is then fetched from the same release site, its checksum is compared with the published one, its code signature is verified as ours, and Encore closes through its normal unsaved-work prompt before the installer runs. A file that fails either check is deleted and not run.

4. Children

Encore is business software and is not directed at children.

5. Legal bases and your rights

Because we do not collect or receive your personal data, we hold nothing about you to access, correct, export or erase. Data stored by Encore is on your own equipment and under your control; you can delete it by removing the folders listed in section 2.

Where the assistant is used, Anthropic acts as the recipient of the content you send. Requests concerning data held by Anthropic should be directed to Anthropic under the account your API key belongs to. Likewise, data written to a Google Sheet is held by Google under the Google account you signed in with.

If you are subject to the UK GDPR, EU GDPR or similar regimes and are using Encore to process someone else's personal data inside a model, you are the controller of that data; we neither receive nor process it.

6. Security

• Your API key, and your Google sign-in if you use the Sheets integration, are encrypted at rest with Windows DPAPI, scoped to your Windows user account. Google access tokens are kept in memory only.
• Communication with the AI provider and with Google uses HTTPS. The Google sign-in uses the OAuth 2.0 flow Google specifies for desktop applications (PKCE, loopback redirect).
• Encore's administrator-mode password, where set, is stored only as a salted PBKDF2-SHA256 hash, never as recoverable text.
• Encore no longer uses .NET BinaryFormatter anywhere; model files are read with format-checked, versioned serialisation.

No software is perfectly secure. Report a suspected vulnerability to rusty.luhring@ferox.com.

7. Changes to this policy

If we change what the software transmits, this policy will be updated and the version and date above changed. Where a change materially widens what is sent, the in-app consent prompt is shown again so you can review it before continuing.

8. Contact

Ferox, LLC 8403 Porter Lane, Alexandria, VA 22308, USA rusty.luhring@ferox.com