Privacy policy

The Kertas Office app

Kertas opens, edits, converts and signs files entirely on your computer. It does not upload your documents, collect usage statistics or require an account. Usage reporting in the third-party editing components it includes is switched off.

The only connection the app makes on its own is to check GitHub Releases for a newer version. GitHub sees your IP address, as with any download, under GitHub's privacy statement. You can turn automatic updates off in Help › About Kertas Office.

Links you choose to open from the app, such as this website or the issue tracker, open in your web browser.

This website

The site is hosted on Cloudflare and uses Cloudflare Web Analytics, which counts page views without cookies or personal identifiers. Installer files are served by GitHub. The roadmap and changelog are fetched from GitHub's public data; no information about you is sent with those requests.

Download counts

GitHub counts how many times each installer file is downloaded. These are totals per file, with no information about who downloaded them.

Support and contact

If you contribute through Buy Me a Coffee or another service, that service handles the payment, and the project only sees what the service shares, never your payment details. If you email hello@kertasoffice.com, your message is used only to reply to you.

Changes

Changes to this policy are made in the public repository, so every edit and its date can be seen in the file's history on GitHub.

Security policy

Please do not report security problems in public issues or discussions.

How to report

• Use GitHub's private vulnerability reporting for the repository. Only maintainers can see the report.
• Or email hello@kertasoffice.com with "Security report" in the subject.
• Include the Kertas version, your system, the steps to reproduce and, if you can, a sample file.

What happens next

Maintainers confirm the problem, work on a fix and release it as an update, which installed copies pick up automatically. Reporters are credited in the release notes unless they prefer not to be.

Supported versions

Security fixes go into the latest release. Because updates install themselves, keeping automatic updates on is the simplest way to stay protected.

Scope

Of most interest: files that can run code or read other files when opened in Kertas, problems that weaken saved encryption or digital signatures, and anything that makes the app send data it should not.

Code signing policy

Windows status: Windows code signing through SignPath Foundation is being set up. Until it is in place, Windows installers are unsigned, and Windows may show a SmartScreen warning the first time. The Windows part of this page describes how that signing will work.

Free code signing for Windows is provided by SignPath.io, with a certificate by SignPath Foundation.

macOS

macOS builds are signed with an Apple Developer ID certificate held by the organization that maintains the project's Apple developer account, and notarized by Apple, which checks each build for malicious software before macOS will open it without a warning.

How releases are built

• Every installer is built by GitHub Actions directly from the public source code in the kertas-office/kertas-office repository.
• Builds run only for tagged versions, and every build first runs the full test suite.
• Only files built this way are signed and published. Nobody signs files built on a personal computer.

Team roles

• Committers and reviewers: members of the kertas-office GitHub organization with write access.
• Approvers: owners of the kertas-office organization, who approve each signing request.

Every team member uses multi-factor authentication for GitHub and for SignPath.

Privacy

The signed app does not transfer information to any networked system unless you ask it to, with one exception: the automatic update check described in the privacy policy, which you can turn off.

Licence

Kertas Office is free software, licensed under the GNU Affero General Public License, version 3 or later (AGPL-3.0-or-later).

• Using Kertas at home, at work, at school or in government is free, with no conditions.
• Changing Kertas is allowed. If you share a changed version, or run it for others over a network, you must share your changes under the same licence.
• Your documents are yours. The licence covers the app, never what you make with it.

Kertas is built on open-source projects, including SuperDoc, Univer, ExcelJS, SheetJS, pdf.js and pdf-lib. Their licences are listed in the repository.

Name and logo use

The code is free to reuse under the licence. The Kertas Office name and logo identify the official app, so people know where a download came from.

• You can use the name and logo to talk about Kertas, link to it, review it or teach it.
• If you publish a modified version, please give it a different name and logo, and say it is based on Kertas Office.
• Please do not suggest that your product, service or download is the official Kertas Office.

Not sure? Ask at hello@kertasoffice.com.