docs: publish signing, privacy and uninstall policies

CODE_SIGNING_POLICY.md

@@ -0,0 +1,72 @@
+# Code signing policy
+
+[Project home](README.md) · [Downloads](https://github.com/qudadd/envscope/releases) · [Privacy](PRIVACY.md) · [Uninstall](docs/UNINSTALL.md)
+
+Last reviewed: **2026-10-31**.
+
+## Current status
+
+EnvScope is preparing an application for free Windows code signing from the
+[SignPath Foundation](https://signpath.org/). **The project has not been accepted
+and does not currently receive signing services from the Foundation.**
+
+The published **0.25.0 Alpha** Windows executables are unsigned. macOS packages
+use ad-hoc signing, without Developer ID signing or Apple notarization. File
+checksums, application identity checks and successful CI runs do not establish
+a trusted publisher signature. The current release remains available with
+these limitations explicitly disclosed.
+
+## People and approval
+
+The current maintainer is [qudadd](https://github.com/qudadd), who performs the
+author, reviewer and release-approver roles. This is a single-maintainer project;
+these roles do not imply an independent second reviewer. The maintainer has
+confirmed that GitHub two-factor authentication is enabled.
+
+If the Foundation accepts the project, all repository and signing-service
+members must use multi-factor authentication. Signing-service access and its
+MFA have not yet been provisioned. Each signing request will require manual
+approval by an authorized maintainer after reviewing its source revision,
+build result and artifact scope. Changes to maintainers or signing permissions
+must be reflected here.
+
+## Builds and signing scope
+
+The repository publishes its [desktop build workflow](.github/workflows/desktop.yml),
+[checks workflow](.github/workflows/checks.yml), tagged source and release
+checksums. Windows and macOS packages are built with GitHub Actions. This is
+source-linked build evidence, not a claim of bit-for-bit reproducibility.
+
+The proposed Windows signing scope is EnvScope's own executable and native
+timezone helper built from this repository. Bundled third-party source,
+libraries and tools retain their upstream attribution and licenses, documented
+in [THIRD_PARTY_NOTICES.md](THIRD_PARTY_NOTICES.md). We will not submit unrelated
+upstream executables for signing as if they were authored by EnvScope. The
+Foundation must review the packaging and diagnostic scope before any signing
+integration is enabled.
+
+Approved signing would be integrated into the controlled build before final
+archives and checksums are generated. Publisher verification and update checks
+also require implementation and validation; publishing this policy does not
+activate them. See the remaining work in the [signing guide](docs/SIGNING.md).
+
+If accepted, the public policy and download pages will identify the signing
+service actually used and credit the Foundation. Its certificates identify
+**SignPath Foundation**, and use remains subject to its
+[Code of Conduct](https://signpath.org/terms), including revocation. No current
+binary should be described as signed by the Foundation.
+
+## Users and project conduct
+
+Diagnostics are read-only. Repairs, account-profile operations and persistent
+maintenance require separate review of their effects and explicit confirmation.
+The project provides local diagnostics and configuration management, not
+accounts, proxy subscriptions, forged device identities or an assurance of
+service eligibility. Its network and proxy-configuration checks are disclosed
+for the Foundation's eligibility review.
+
+External requests, local data and user controls are described in the
+[privacy notice](PRIVACY.md). Users can stop scheduled components and remove
+the application using the [uninstall guide](docs/UNINSTALL.md). Report a
+suspected compromised release through the channels in [SECURITY.md](SECURITY.md);
+do not include credentials or private diagnostic files in a public issue.

PRIVACY.md

@@ -0,0 +1,114 @@
+# Privacy notice
+
+本说明介绍 EnvScope 读取什么、何时联网、如何保存及移除本地资料。当前软件没有 EnvScope 运营的上传服务器或分析统计服务。
+
+Applies to EnvScope **0.25.0 Alpha**. Last reviewed: **2026-10-31**.
+
+## Local processing
+
+EnvScope is an open-source Windows and macOS application maintained at
+[qudadd/envscope](https://github.com/qudadd/envscope). It has no project-operated
+backend, analytics SDK or automatic diagnostic-report upload. The desktop
+interface communicates with its own loopback service. Opening a GitHub issue,
+following an external link or using a third-party client involves that service
+separately.
+
+Depending on selected checks, EnvScope reads operating-system and application
+versions, timezone and locale, selected client settings, DNS and network-route
+metadata, proxy configuration, process metadata, disk availability and network
+test results. Some checks may be unavailable without OS authorization. Native
+diagnostics do not change settings. Repairs and persistent maintenance have
+their own effect preview and confirmation.
+
+Account operations are separate from diagnostics. When explicitly authorized,
+they copy or exchange local Claude profile directories, which can contain
+cookies, login credentials, identity files and other private state. They do not
+upload these copies to EnvScope. OS credential stores are not fully included in
+these copies. See [account data and recovery](docs/ACCOUNT_VOLUMES.md).
+
+## Requests to external services
+
+Network tests start when the user requests detection, uses a relevant tool, or
+enables a maintenance plan that includes those tests. Online command-line probes
+require `--online`; native UDP STUN additionally requires `--stun`.
+
+**The desktop application checks GitHub for software updates by default**, at
+startup and periodically while running. This can be disabled in the software
+update/background settings. Downloading, installing or restarting into a new
+version requires confirmation. Checking for updates is separate from consent
+to run diagnostics or maintenance.
+
+These requests disclose the source IP seen by the recipient and normal request
+metadata, such as time, requested host/path and user agent. DNS queries are also
+visible to the resolver handling them. Proxy or VPN use may change the source
+seen by a destination; it does not make the requests anonymous.
+
+| Service | Purpose and data sent | Provider information |
+|---|---|---|
+| Cloudflare | HTTP connection/public-IP observations and UDP STUN; network request metadata | [Privacy policy](https://www.cloudflare.com/privacypolicy/) |
+| ipify | IPv4/IPv6 public-IP observations; network request metadata | [API provider website](https://www.ipify.org/) |
+| IPinfo | Requested IP-region suggestions and network/ASN information; network request metadata | [Privacy policy](https://ipinfo.io/privacy-policy) |
+| Google STUN | Optional native UDP and browser ICE observations; STUN request metadata | [Privacy policy](https://policies.google.com/privacy) |
+| Anthropic / Claude | Anonymous service-response checks; network request metadata | [Privacy policy](https://www.anthropic.com/legal/privacy) |
+| GitHub | Release/upstream-version checks and requested downloads; requested repository paths and application user agent | [Privacy statement](https://docs.github.com/en/site-policy/privacy-policies/github-general-privacy-statement) |
+| Optional ecosystem endpoints | Anonymous reachability requests to Cloudflare, Datadog, Segment/Twilio, Stripe and Intercom domains | [Datadog](https://www.datadoghq.com/legal/privacy/), [Twilio](https://www.twilio.com/en-us/legal/privacy), [Stripe](https://stripe.com/privacy), [Intercom](https://www.intercom.com/legal/privacy) |
+
+The ipify API homepage is linked as provider information, not as a verified
+separate privacy-policy page. Third-party policies and retention practices are
+controlled by those providers.
+
+HTTP diagnostic probes do not attach Claude login credentials, browser cookies
+or profile files. Ecosystem checks are reachability requests; EnvScope does not
+embed those services' analytics SDKs. Browser observations are returned to the
+local EnvScope process. A user-specified proxy may receive its supplied proxy
+credentials and network requests; custom command-line targets contact the
+destinations selected by the operator.
+
+Optional temporary browser sessions run an installed browser with a separate
+profile. Websites the user visits receive ordinary browser traffic; they are
+not covered by a promise of anonymity. Explicit upstream installation/update
+tools also have their own behavior and permissions, disclosed separately.
+
+## Files, retention and sharing
+
+Application preferences, recent diagnostic history, recovery backups, update
+packages, browser-session records and maintenance logs are normally stored
+under `~/.envscope` in the current user's home directory. Account slots and
+some upstream-compatible state use `~/.claude-switcher`. Separately authorized
+privileged timezone services store their protected state at the fixed system
+paths listed in the [timezone service guide](docs/TIMEZONE_SERVICE.md).
+
+Normal diagnostic history keeps the latest 50 redacted records. A local random
+HMAC key enables address-change comparison without saving plain addresses in
+that comparison record. This is not complete anonymization: system details and
+user-entered settings, such as permitted address ranges, can still identify the
+environment. Operators can explicitly request sensitive local CLI output with
+`--include-sensitive`. Daily event logs and recovery backups are retained for
+review and recovery; they are not all automatically deleted with old history.
+
+**Original configuration backups and directory-based account copies are not
+encrypted and may contain secrets.** They are excluded from normal diagnostic
+exports. Optional encrypted account archives have their own password and format
+requirements; they do not encrypt every application file. Temporary browser
+cleanup removes eligible files after the authorized session closes, but failed
+cleanup retains data for a later retry. Deletion is not guaranteed secure erasure.
+
+Diagnostic reports and support bundles use best-effort redaction, not a guarantee
+that all sensitive information has been removed. Review every file before
+sharing it. Do not upload account slots, raw backups, browser profiles, tokens
+or proxy credentials to a public issue.
+
+## Your controls and contact
+
+You can choose applicable tests, turn off automatic update checks, decline a
+repair, and disable approved maintenance. User maintenance, the optional process
+guard and the privileged timezone service are separate components; closing the
+window does not disable them. See [uninstall and data removal](docs/UNINSTALL.md)
+for stopping them, restoring supported changes and removing local files.
+
+Privacy questions can be raised with the maintainer through the project's
+[issues](https://github.com/qudadd/envscope/issues) without including private
+data. For security-sensitive reports, follow [SECURITY.md](SECURITY.md). The
+project has no central copy from which to retrieve or delete your local data.
+This notice is versioned in the public repository and should be updated when
+data handling changes.

README.md

@@ -20,6 +20,8 @@
 
 当前 Windows 包未进行发布者签名；macOS 包使用 ad-hoc 签名，尚未进行 Developer ID 签名或 Apple 公证。首次打开可能被系统拦截。下载校验与签名是不同的验证，详见 [开源构建与更新](docs/OPEN_SOURCE_BUILDS.md)、[正式签名准备](docs/SIGNING.md)。
 
+[Code signing policy](CODE_SIGNING_POLICY.md)：正在准备 SignPath Foundation 开源签名申请，尚未获批或接入。另见 [隐私说明](PRIVACY.md)、[卸载与资料移除](docs/UNINSTALL.md)。
+
 ## 四步使用
 
 1. **确认目标**：填写实际使用地区，读取出口 IP 建议节点国家与城市，匹配时区和地区格式。实际所在地与代理出口分别记录。
@@ -62,7 +64,7 @@
 - 地区预设不等于 Claude 支持地区。修改时区、语言或节点不改变实际所在地，也不保证账号安全或服务端设备判断。
 - 诊断只读；修复、账号切换和守护分别审核。配置原文备份可能含凭据，请勿上传；分享诊断包前也应复核。
 
-权限、平台与真实设备的验证范围见 [验收记录](docs/DESKTOP_ACCEPTANCE.md)；数据处理边界见 [SECURITY.md](SECURITY.md)。
+权限、平台与真实设备的验证范围见 [验收记录](docs/DESKTOP_ACCEPTANCE.md)；数据处理见 [隐私说明](PRIVACY.md)，实现边界见 [SECURITY.md](SECURITY.md)。
 
 ## 与 claude-switcher 的关系
 

SECURITY.md

@@ -1,5 +1,9 @@
 # Security and privacy boundaries
 
+For data handling, external services and user controls, see the
+[privacy notice](PRIVACY.md). For stopping background components and removing
+local data, see the [uninstall guide](docs/UNINSTALL.md).
+
 ## Reviewed configuration remedies
 
 Diagnostics do not change system or client settings. A separate reviewed plan
@@ -153,9 +157,10 @@ privilege, backup and rollback behavior. Their bundled hashes verify provenance,
 not native-device acceptance. Installers can register background services and
 the macOS original updater. Original output is marked unverified by EnvScope.
 
-Local history and preferences are under `~/.envscope`; no raw addresses are
-stored there by the normal UI. Comparison uses a private random HMAC key and
-does not infer IP ownership or risk. Loss of that key invalidates comparisons.
+Local history and preferences are under `~/.envscope`. Normal diagnostic history
+redacts observed addresses; user-entered settings, including permitted address
+ranges, may still contain addresses. Comparison uses a private random HMAC key
+and does not infer IP ownership or risk. Loss of that key invalidates comparisons.
 Redaction is best effort, not a guarantee of anonymization.
 
 ## Reporting an issue

docs/README.md

@@ -13,6 +13,7 @@
 | 选择项目、全选、批量修复 | [可选检查](SELECTIVE_CHECKS.md) · [检查偏好](CHECK_PREFERENCES.md) |
 | 查明问题、了解检测证据 | [检测与处理](DIAGNOSIS.md) · [环境覆盖](ENVIRONMENT_COVERAGE.md) · [逐项检查](CLAUDE_CHECKS.md) |
 | 确认权限问题和软件能力边界 | [权限验收与限制](PERMISSION_ACCEPTANCE.md) |
+| 了解联网与数据处理、停止后台组件及卸载 | [隐私说明](../PRIVACY.md) · [卸载与资料移除](UNINSTALL.md) |
 | 比较原项目、平台和实现范围 | [完整功能对照](FULL_PARITY_AUDIT.md) |
 
 ## 修复与长期保持
@@ -44,7 +45,7 @@
 | 命令行、策略、报告与证据解释 | [CLI](CLI.md) |
 | 模块与安全边界 | [架构](ARCHITECTURE.md) · [安全与隐私](../SECURITY.md) |
 | 桌面与权限测试的已验证 / 待验证范围 | [桌面验收](DESKTOP_ACCEPTANCE.md) · [权限验收](PERMISSION_ACCEPTANCE.md) |
-| Windows 签名、Apple 签名与公证所需条件 | [正式签名准备](SIGNING.md) |
+| Windows 签名、Apple 签名与公证所需条件 | [正式签名准备](SIGNING.md) · [Code signing policy](../CODE_SIGNING_POLICY.md) |
 | 界面与交互原则 | [桌面设计](UI_DESIGN.md) |
 | 参考项目、固定版本与许可 | [源码研究](RESEARCH.md) · [来源与许可](../THIRD_PARTY_NOTICES.md) |