Privacy policy The website and Roxora Imager

Summary

Neither the website nor Roxora Imager has accounts, analytics or telemetry, and neither sets cookies. Roxora Imager fetches the release list, the images you choose and Rockchip’s loader files, all from GitHub, and once a day asks GitHub whether there is a newer version, which you can turn off. Nothing is sent about you or your computer beyond what any web request carries.

Every address below is fetched over HTTPS. Whoever runs the server at the other end (GitHub, and Cloudflare for the download proxy) receives your IP address and the request, as any web server does, and their own privacy policies cover what they record.

This website

Hosting: GitHub Pages serves the site. What GitHub records about requests is covered by GitHub’s privacy statement.
Loaded from elsewhere: Nothing. Fonts, styles and scripts are served from this domain.
Cookies and analytics: None. Your visit is not counted.
Kept in your browser: Your light or dark choice, in local storage. Nothing else.
Search: Runs in your browser. What you type is not sent anywhere.

Roxora Imager

What the desktop app fetches, and when:

When it starts: The list of Roxora releases from api.github.com (the releases of roxora-os/build), and the roxora-catalog.json of each from the release files on github.com.
When you write an image: The image you chose, and for the Radxa ROCK 4D its SPI bootloader image, from the releases of roxora-os/build on github.com, which hands the download to GitHub’s file servers. Each file is checked against the release’s SHA-256 and kept in the app’s user data folder (images/).
First write over USB (Maskrom): Rockchip’s loader files from raw.githubusercontent.com/rockchip-linux/rkbin at a pinned commit, checked against pinned SHA-256 sums and kept in the user data folder (loaders/).
Update check: At most once a day, the newest release of Roxora Imager from api.github.com. If there is a newer version the app says so and links its release page; it does not download or install anything. Turn it off in the app’s settings: Check for a new version once a day.
Links: A link in the app opens in your web browser, only when you click it.
Kept on your computer: Its settings (settings.json), the downloaded images and the loader, in the app’s user data folder. Nothing is uploaded.

Roxora Imager in the browser

The web version at roxora-os.github.io/imager is served by GitHub Pages like this site. It fetches:

The release list: From this site’s copy of the catalogs (roxora-os.github.io/catalog/), checked against the release list from api.github.com.
Release files: A browser cannot download GitHub release files itself. When the build has a download proxy, the files come through it: a Cloudflare Worker run by the project that serves only Roxora release files and keeps no log of its own. Otherwise you download the file yourself and pick it. The version published now has no proxy.
Loader files: From raw.githubusercontent.com/rockchip-linux/rkbin at the same pinned commit, checked the same way.

Questions

Write to oss@gahingwoo.com. The sources of the website and of Roxora Imager are public: roxora-os/roxora-os.github.io and roxora-os/imager.