Free, Pro and how licenses stay secure
Plans, caps, welcome coupons and the security model behind the license server.
Plans
| Capability | Free | Pro |
|---|---|---|
| Timeline events | 100 (then recording pauses) | Unlimited |
| Workspaces | 1 | Up to 5 |
| Restore / rollback / undo | Always available | Always available |
| Term | — | Per license (e.g. 30-day trial) |
On the free plan, new file-change events stop being recorded once the 100-event cap is reached, but restore-point operations (rollback, undo, redo, checkpoint) always work — they are safety operations and are never blocked. Your existing history is never deleted or locked.
Check your plan
Check plan, event usage and days remaining from any surface:
In the desktop app, see Settings → Pro Plan. On the website, the My License dashboard shows the same information for any license key.
Welcome coupons
New users can redeem a single-use WELCOME-XXXX-XXXX-XXXX coupon for a
30-day Pro trial. On the website you can receive one by verifying your email during
signup/download; the key is emailed to you. Redeem it in the app (Settings → Pro Plan) or via the CLI:
One coupon, one machine, one redemption: re-using a spent coupon fails. When a Pro license expires, ROW Recall automatically returns to the free plan (with its 100-event cap).
How licensing security works
- Ed25519-signed — licenses are signed by the license server; the client verifies the signature before applying, so no license can be forged offline.
- Encrypted delivery — the redeem request and response are encrypted with AES-256-GCM, keyed by an X25519 (ECDH) shared secret derived from a client ephemeral key and the server’s static public key.
- Machine-bound — each license is tied to a machine fingerprint
(HMAC-SHA256 over the Windows MachineGuid + CPU id + volume serial; on Linux,
/etc/machine-id). A license can’t be moved to another machine silently. - Session lock — the server enforces one active session per license via heartbeats, and the client downgrades to free if the server reports the license is locked or expired. It is offline-first: transient network errors are ignored.
Recovery and the account/device model (Stage 0)
Today a license is bound to a machine (see Security & Privacy for how the database key is managed and recovered across a formatted or replaced PC). As part of the Stage 0 roadmap, licensing is moving from a one-machine-forever model to an account identity with an authorized device list:
- Personal — a limited number of personal devices
- Professional — multiple personal devices
- Team / Enterprise — team-managed devices and workspaces
This is what makes cross-device recovery and the future team features possible, while keeping licenses from being shared freely. Under the hood, the backend already stores ciphertext-only recovery blobs per account — the plaintext key and history never reach the server.
One honest note
No offline license system is uncrackable. ROW Recall uses a practical stack — Ed25519 authenticity + AES-256-GCM confidentiality + machine binding + server-side session lock — to keep normal users honest, not to make impossible claims.