Privacy

• Borea collects no usage data, no telemetry and no crash reports, and it sends nothing about you anywhere.
• Your instances, mods, settings, logs and backups stay in folders on your computer. Nothing is uploaded.
• The requests below are what a mod manager needs: the list of mods, the files you choose to install, and an update check.
• Every request carries Borea's name and version as its user agent, for example Borea/0.4.0 (+https://github.com/KSAModding/Borea), and nothing else that identifies you. Each service sees your IP address, as with any download.

These run without you asking, and most of them can be switched off.

• The content index, served from GitHub Pages (privacy). The list of mods, packs and their releases, fetched at start and when you refresh Discover. This is what Borea is for, so it has no switch. Without it the app shows what it downloaded last.
• Announcements, from GitHub (privacy). Short posts from the KSAModding team on Home. Off with Settings, General, "Show news from the KSAModding team".
• The Borea releases, from GitHub (privacy). The update check at start, and the download when you update. Off with Settings, General, "Check for updates at start". Installing an update is always something you confirm.
• The KSA version list, from GitHub (privacy). The order of game builds, so Borea can tell which mod version fits which build. No switch. It is one small static file and the request says nothing about your install.
• The KSA master server of RocketWerkz. The current public build of the game, so Borea can tell you that your install is behind. Asked once per start, and only when a KSA install was found. No switch yet.
• Listing images, from the hosts the mod authors chose. The icons and screenshots on a listing. On by default, and each request tells that host your IP address, which the setting says too. Off with Settings, General, "Load images from author hosts".

• Mod downloads. Installing a mod downloads it from the host its listing names, usually GitHub or SpaceDock (privacy). That host sees the download.
• Signing in to GitHub. Only if you choose to, for publishing a listing or for the steward tools. Borea uses GitHub's device flow, so your password never reaches Borea, and the token it receives goes into your system's secret store. "Stay signed in on this computer" in Settings, General decides whether it survives a restart, and you can revoke it at any time in your GitHub settings.
• The listing tool. Publishing a listing opens a pull request on the content index with the data you entered, which is public. It also reads the prefix of the forum thread you give, from forums.ahwoo.com, to suggest a tag.
• Links. Opening a link from inside Borea hands it to your browser.

Borea keeps its settings, its instances, the mods it installed, its task history, its logs and its backups in its own folders, next to the game's own data. Nothing in them is sent anywhere. Removing those folders removes everything Borea knows.

The CLI behaves the same way as the App, and it reads the same settings.

If something here does not match what you see, or you find a request that is not listed, open an issue in the tracker, or report it privately through SECURITY.md if you would rather not do that in public.