Signing and privacy
Code signing policy
How Surco's installers are signed, who decides what gets signed and what data leaves your computer.
Signing
Free code signing provided by SignPath.io, certificate by SignPath Foundation.
The signature proves the installer was published by Surco and that nobody changed it afterwards.
Only installers built from Surco's public source code by its GitHub Actions release pipeline are signed, and every release is approved by hand before it is signed.
On macOS, Surco is signed and notarized by Apple.
The first signed Windows release has not shipped yet. Until then the Windows installer is published unsigned.
Team
Surco is developed and maintained by one person, who holds all three roles.
- Author
- Vicent GozalbesCan change the source code without further review.
- Reviewer
- Vicent GozalbesReviews every change that comes from outside the team.
- Approver
- Vicent GozalbesApproves every signing request and decides which releases get signed.
Source code github.com/surco-app/surco
Privacy
Surco has no account and no telemetry, and sends nothing to any Surco server. The app only connects to other services in these cases.
- When you search for a track, by hand or with auto-match, it sends the title, the artist and other search details to the sources you have turned on. These can be Discogs, Bandcamp, Deezer, Beatport and MusicBrainz. Artwork is downloaded from their servers and from Cover Art Archive.
- If you connect your Beatport account, your username and password only travel to Beatport. The password is stored encrypted on your computer.
- To find out whether there is a new version, it checks the releases published on GitHub and downloads the update from there.
- If you report a bug, it opens a GitHub form in your browser with the version, the system and the latest error lines, without folder paths. Nothing is sent until you post it yourself.
Each service has its own privacy policy