Changelog

First Windows release, ported from the macOS build. The archive, the search, and the one-time-code detection are the same idea carried over. The way Pingr actually watches for notifications on Windows is genuinely different code, not a translation, because Windows offers no equivalent to the readable notification store the Mac build watches.

The capture engine

• Searchable notification timeline, full-text indexed with SQLite FTS5 and prefix matching, so results narrow as you type.
• One-time code detection with a copy button in the detail view, and the newest code one click away in the notification-area icon.
• Capture is poll-based, not event-driven. UserNotificationListener works from an unpackaged process, but its NotificationChanged push event does not: it needs package identity Pingr doesn't have as a plain desktop app. Default poll is 1 second, measured at 0.00 ms of CPU per poll (it's an API call that waits, not work); a notification dismissed faster than the interval can be missed, and Settings says so plainly.
• Toasts only. A notification an app never routes through the Action Center isn't visible to any Windows API, Pingr included.

Data & safety

• Per-app exclusions. Excluding an app deletes what Pingr already has from it, after naming the app and counting what's about to go.
• Retention: 1 week, 30 days, 90 days, 1 year or forever (the same choices and the same 90-day default as the macOS build). Pruned at launch and hourly.
• Optional code scrubbing (Never / 1 hour / 24 hours / 1 week) removes the stored one-time code from rows past their useful life while keeping the notification. Off by default, matching macOS. Windows-only; the honest limitation (it clears the indexed code field, not the digits if they also appear written out in the message body) is documented in SECURITY.md.
• The archive lives in %LOCALAPPDATA% rather than %APPDATA%, so a roaming profile never copies one-time codes to a file server.
• Owner-only file permissions are real Windows ACLs written with SetNamedSecurityInfoW, not os.chmod, which does nothing meaningful on Windows. This restricts the archive to your account; it cannot and does not stop a local administrator.
• Deleting a notification, an exclusion, or a retention sweep runs secure_delete and checkpoints the write-ahead log, so a deleted row doesn't sit readable in a free database page.

Windows fit & finish

• Per-user install into %LOCALAPPDATA%\Programs\Pingr: no UAC prompt, no admin rights.
• Mica window chrome, rounded corners and an immersive dark title bar that follows your light, dark or system appearance choice.
• Self-update in place, the job Sparkle does on the Mac. Pingr downloads the new installer, verifies its Authenticode signature against CN=Jeremy Harris and that its version matches what was advertised, installs over itself and reopens. The Mac build still asks you to re-download by hand.
• --selfcheck proves the whole capture path (the listener, access status, a live poll, the archive, FTS5, file ownership) against the real OS, since the unit test suite runs against a fake source and can't notice Windows changing under it.

Language & accessibility

• 13 languages, chosen in Settings: English, Spanish, French, German, Italian, Portuguese (BR), Dutch, Polish, Russian, Turkish, Japanese, Simplified Chinese, Korean.
• WCAG 2.1 AA: the timeline is a real listbox with a live result count, codes are announced digit-by-digit rather than as a number, and contrast is computed and measured against the surfaces the app actually paints, not just asserted.

Not ported from macOS

• Sparkle. Windows uses the fleet's Authenticode-anchored updater.py instead (see "Windows fit & finish" above).
• Full Disk Access onboarding. Windows has a real, narrower consent API instead (UserNotificationListener's own access prompt), which is a better privacy story than the broad permission the Mac build has to ask for, not a worse one.
• Exporting the current search to CSV, JSON or Markdown, and undo after a delete, are both on the Mac build and not yet on this one.

Known in this beta

• Notification access is one global switch, not a per-app row: an unpackaged app doesn't get one under Settings → Notifications, so turning access off is all-or-nothing for every app at once.
• The 1-second poll (adjustable down to half a second) means a notification dismissed unusually fast can, in principle, be missed. See the FAQ for the full explanation.
• No undo yet after deleting a notification. Deletion is immediate and, by design, thorough.
• Delete-by-app-exclusion matches case-insensitively, unlike the Mac build's exact match. On Windows the app key is an AUMID (effectively a file path for a desktop app), so casing drifts between launches, and an exact match would leave history behind for an app you just told Pingr to forget.
• Accessibility has a thorough automated pass (structural checks and measured contrast in the test suite) but has not yet had a human screen-reader pass with Narrator or NVDA. If you use one, that feedback is some of the most valuable you could send.