FAQ

Where do downloads come from?

• Source ports and third-party tools are downloaded directly from repositories controlled by the original project authors, typically hosted on GitHub or on the authors’ self-hosted release servers.
• Addons are hosted on a private MinIO server and are distributed exclusively from there.

How is file integrity verified and what trust assumptions are made?

• Each addon is manually reviewed by a maintainer before being added to the database.

• The database stores an MD5 hash of the zipped addon. After download, the hash is recalculated and compared. If the hash does not match, the file is immediately deleted.

• MinIO storage is trusted to deliver files without modification, but integrity checks ensure tampering is detected.

• Third-party tools are downloaded only from official release pages of the project.

• Third-party GitHub repositories are trusted only to the extent that the project authors control their release process. A compromised upstream project can still distribute malicious code.

• When available, release checksums or GitHub release signatures are verified.

Do the app or third-party tools require administrator privileges?

• No. Neither the app nor any bundled or downloaded third-party tools require administrator (root) privileges to run. All functionality operates under standard user permissions, and no elevated access is requested or needed.

Is any telemetry or data collected by the app?

• No. The app does not collect, store, or transmit telemetry, analytics, usage metrics, or any personal data.
• Users may explicitly upload files as part of normal functionality, but only the files themselves are transmitted. No additional metadata, identifiers, or background data is sent, and nothing is shared with third parties.