Skip to main content
Student records stay on the computer Sightline runs on; Sightline has no server that receives them. How Sightline handles student data is the plain-language version of this page.

​
Code signing

Christopher Ives is the name on the signing certificates. Windows lists the installed app’s publisher as Ethoseen LLC, the company that sells Sightline. Bundle identifier: com.sightline.app. To check a Mac copy, run codesign -dv --verbose=4 /Applications/Sightline.app and look for TeamIdentifier=SJQ7XBC6W5. On Windows, run Get-AuthenticodeSignature on the installer and expect Status: Valid. The Windows certificate is replaced daily and each one is valid for three days, so don’t trust it by thumbprint. Every certificate carries the same Artifact Signing identity EKU, 1.3.6.1.4.1.311.97.93852484.924677978.522928787.809106358. Microsoft Defender SmartScreen can still warn about a new installer; see Install on Windows.

​
Installing without admin rights

On Windows, Sightline_<version>_x64-setup.exe installs for the current user only, in %LOCALAPPDATA%\Sightline, and never asks for administrator rights. There is no MSI or machine-wide installer. If the WebView2 Runtime is missing, the installer downloads it from Microsoft; on restricted networks, preinstall the Evergreen WebView2 Runtime.
  • Deploy with Intune or Configuration Manager in user context, not system context.
  • AppLocker’s default rules block programs in the user profile. Add a publisher rule for Christopher Ives.
  • With App Control for Business, use a signer rule that pins the EKU above together with the publisher name. A rule on the name alone would also trust any other Artifact Signing customer validated under that name. Bundled libraries signed by others also need allowing: vulkan-1.dll (LunarG) and the Visual C++ runtime DLLs (Microsoft).
On a Mac, Sightline ships as a disk image. Install it to /Applications by MDM or by dragging, or to ~/Applications, which needs no administrator password.

​
District-managed Macs

A standard account can’t update an app in /Applications, so Sightline opened from there asks “Copy Sightline to get updates?”. Copy and open copies it to the user’s ~/Applications, which updates itself. The original stays, and opening it later opens the user’s copy. Inventory tools such as Jamf report the /Applications version, which may be older than the one the user runs. An older Sightline won’t open data a newer version has already opened. Details for users: Install on Mac.

​
Updates

Sightline checks updates.sightlinebehavior.com when it starts and every six hours while it is open. It downloads an update in the background and installs it the next time the user quits Sightline, or sooner if they choose Restart now. It installs only updates signed with Sightline’s updater key. On Windows, updates install per user, like the original install. There is no setting to turn update checks off. If you block the update host, Sightline keeps working, and after several days of failed checks it shows a banner saying it couldn’t check for updates.

​
Network connections

Sightline works offline. These are the only hosts it contacts. None of them receives student records. The last four rows are optional or user-initiated and can be blocked without affecting recording. On Windows, Sightline sends its requests through the proxy Windows is set to use, including a PAC file or automatic detection.

​
Where files are stored

The data folder holds the encrypted database, automatic backups, downloaded models, and license files. If Companion is used, it also receives observations returned from the iPhone and deletes each one once it is saved. One that can’t be imported yet stays there, encrypted with its voice-note audio, under Needs attention until it is imported or discarded. On Windows it is local, not roaming. Sightline keeps three secrets in the operating system’s credential store: the database encryption key, the license key, and, once a phone is paired, the Companion pairing key. On a Mac they are Keychain items named com.sightline.app and Sightline Companion. On Windows they are generic credentials named database-key.com.sightline.app, license-key.com.sightline.app, and pairing-v2.Sightline Companion. A data folder can’t be opened without its database key, so a keychain reset loses the records unless the user has a passphrase backup. The Windows uninstaller can delete the data folder but not these credentials; see Install on Windows.

​
Bluetooth for Companion

Companion, the iPhone app, connects to the computer over Bluetooth Low Energy, with no network involved. The link is encrypted, and messages are authenticated with a key exchanged at pairing. Companion makes no internet requests. An observation recorded away from the computer stays on the iPhone, in storage left out of device backups, until the computer confirms it has saved it.

​
Diagnostics in feedback

Send feedback attaches diagnostics only if the user selects Include diagnostics. They contain app and system information, license tier and status, AI and model state, database counts and size, selected settings, and filtered logs. They leave out student names, notes, observations, license keys, and the text of log messages. Log files themselves can contain student names and notes, so support asks for Send feedback with Include diagnostics instead of the log files. To report a security issue, email support@sightlinebehavior.com with the subject “[SECURITY] Private vulnerability report”. Leave exploit details and student records out of the first email; we will arrange a secure channel.