Start with the ordinary questions#
| Question | Answer |
|---|---|
| Do I need a Kurdistan account? | The reviewed product architecture does not require a central Kurdistan account. A deployment owner or host may have separate requirements. |
| Where are app profiles kept? | The Android foundation describes locally encrypted, Keystore-backed storage. The browser preview uses synthetic records, not a secure profile vault. |
| Does the product require analytics? | No analytics, advertising or remote crash-reporting service is required by the reviewed design. |
| What can my VPS see? | The owner and hosting provider remain in your trust model. Do not infer an operator log policy or universal anonymity guarantee from this website. |
| Does this website track me? | This build contains no analytics, advertising, fingerprinting or session replay integration. Read website privacy |
| Who receives a support summary? | No website support upload exists. Review and explicitly share only redacted material with the intended recipient. |
The product boundary#
No required product advertising or analytics service.Implemented in sourceView evidence
- What this means
- Independent deployments do not depend on a Kurdistan advertising, analytics or remote crash-reporting service.
- How the design works
- The repository specifies local custody and categorical, secret-safe diagnostics rather than central traffic logging.
- The limit
- This does not establish a logging policy for every operator or VPS host. The website has its own, separate privacy notice.
Reviewed . Source code alone is not release qualification.
Android profile storage is designed around local encryption.Implemented in sourceView evidence
- What this means
- The reviewed Android foundation uses encrypted storage backed by Android Keystore.
- How the design works
- Sensitive profile admission is bounded; the app accesses verification through a native Go bridge.
- The limit
- The browser preview is not that secure store. A compromised device or unsafe backup can still expose information.
Reviewed . Source code alone is not release qualification.
Your operator is a separate party#
A deployment owner controls the profile and the server. The project’s decentralised model does not certify the behaviour, retention policy or security of every independently operated deployment.
Ask the operator what they retain, who hosts the server and how they handle revocation and recovery. Use encrypted application protocols where appropriate; a VPN does not replace them.
Source and scope
Reviewed . The linked source describes the implementation; released-build evidence is a separate check.