Code signing policy
How HatchZip's Windows programs are signed, who approves each signing, and what the programs do with your data.
Code signing
Free code signing provided by SignPath.io, certificate by SignPath Foundation.
HatchZip has applied to the SignPath Foundation. Until the application is approved, the Windows downloads are not code-signed. Every download can still be checked with its SHA-256 checksum and its signed build provenance: Verify your download.
What is signed: the Windows programs hatchzip.exe and hatchzip-gui.exe, the setup HatchZip-x64-setup.exe and the installer HatchZip-x64.msi of each release. They are built from the tagged source in the public repository by the release workflow on GitHub Actions. Nothing built anywhere else, and nothing from another project, is signed.
Team roles
- Committers and reviewers: Yash Bavadiya
- Approvers: Yash Bavadiya
Every signing request is approved by hand. Changes to the source come only through the public repository, where CI tests every change on Linux, macOS and Windows.
Privacy policy
This program will not transfer any information to other networked systems unless specifically requested by the user or the person installing or operating it.
HatchZip has no networking code and no networking library, no telemetry and no accounts. It reads the archive on your disk and writes the files next to it. The desktop app's two links, to the source code and to the latest release under Help, Check for updates, open in your web browser when you click them.
This website, hatchzip.dev, counts visits with Cloudflare Web Analytics, which sets no cookies and stores nothing on your device. It reports which pages are visited, the referring site, and the country, browser and device type. The site has no accounts, forms or advertising.