Privacy and security

What the program contacts

• KeyAuth (keyauth.win): license sign-in and periodic session check. It receives your license key (or the one-time web token) and a hardware identifier (your Windows account SID) that KeyAuth uses to lock a license to one PC.
• The release host (https://hideway-dl.hideway.workers.dev/update): the update check downloads release.json and release.sig, and the game-data check downloads offsets/offsets.json, offsets/offsets.sig and the two offset files they name (also signed). No license data and no identifiers are sent.

Nothing else leaves your PC. Settings, logs and saved sign-in data stay local; the remembered key is encrypted with Windows DPAPI for your account.

Optional: sharing the radar online

The web radar is local by default and sends nothing to the internet. If the user turns on Share radar online, the program sends the radar snapshots (player positions, team, health and, only when Web radar names is on, names) over HTTPS to the Hideway radar relay, a Cloudflare Worker run by the publisher, so a friend can open a link. The relay keeps the latest snapshot in memory for two minutes and stores only the room name and two keys; it does not store history or identify the viewers. The link carries a secret key, anyone who has it can watch, and New online link cuts it off. The option is off by default and nothing is sent while it is off.

Support reports and the help page

Nothing is sent to support unless the user presses a button (the launcher's Help page, the overlay's Debug page, or the web help page). A report contains the text the user typed, a category, an optional contact name, the program version and, only if the user keeps Attach diagnostics on, the system checks and the end of the program logs with the Windows profile path and user name removed (and, from the overlay, the black box: counts of what was drawn, no names and no positions). It never contains the license key. The publisher can read the report; the user gets a ticket number and a secret token to read the answer, and only a hash of the token is stored. One announcement text written by the publisher is fetched by the program (a request with no data in it) so it can show it.

How downloads and updates are protected

• Every release is described by a release.json signed with the publisher's private key (ECDSA P-256). The program contains only the public key and refuses anything not signed by it, older versions, other applications and other channels.
• Each file is checked against its SHA-256 and size from the signed manifest before it is installed, and again by the separate installer.
• Installs are transactional: old files are kept in a backup, the new ones are verified after copying, and the previous version is restored if the new one does not start.
• The signing key never leaves the publisher's machine. It is not in the program, this site or any package.

Web Loader

The sign-in handoff listens only on 127.0.0.1, accepts a single request type, only from the KeyAuth customer panel, uses each token once, and unlocks nothing until KeyAuth confirms the token.

Limits you should know about

• Hash and signature checks prove a file is the publisher's; they do not prove the publisher's software is harmless. The executables are not Authenticode code-signed yet (no code-signing certificate has been purchased). Windows SmartScreen may warn on first start. Releases are still cryptographically signed: verify them as described below.
• Any program running on your own PC can be modified by someone with administrator access to that PC; licensing protects the license, not the code on your machine.