Code signing policy

How thinky's releases are built and signed.

Windows

The Windows files aren't signed with a code-signing certificate yet, so Windows may warn before installing them: choose More info, then Run anyway. When they are signed, this page will say who signs them.

Every release is built by GitHub Actions from the public source code on the main branch and approved by hand before it is published. Nothing built on a personal computer is ever released. Once code signing starts, only thinky's own programs will be signed: the installer and the portable program.

Separately, each Windows update carries a signature from thinky's own update key, and the installed app refuses any update that doesn't carry it.

Android

The Android app is signed with thinky's own release key, kept as a protected secret of the build and used only after the maintainer approves a release. Android only installs an update signed with the same key as the app you have.

Team and roles

• Committers and reviewers: Srikanth Iyer. Most of the code is written with Claude, Anthropic's AI assistant, and goes in only after the project's automated tests pass. Changes from anyone else come as pull requests, which are reviewed before they are merged.
• Approvers: Srikanth Iyer approves every release before it is signed.

Privacy

thinky doesn't send your notes or anything about you anywhere. It uses the network only to check GitHub for a newer release once a day, to load pictures from the web that your notes show, and when you click a link or a button that says so. The privacy policy has the details.

What thinky changes on your computer

• The Windows installer puts thinky in your own user folder (no administrator rights), adds Start-menu shortcuts and registers leanoutliner:// links, so a link to a thinky page opens the app.
• If you choose a shortcut key in Settings › Capture, a tiny helper starts with Windows to listen for it; Settings says so, and removing the key turns it off.
• If you click Set up under Settings › Capture › Highlights from your browser, thinky registers itself so the browser extension can reach it in Edge and Chrome.
• Uninstalling: Windows Settings › Apps › Installed apps › thinky › Uninstall. It removes the program, its shortcuts, the helper, the links and the browser registration. Your notes folder is never touched; thinky's own settings stay in your user folder until you delete them. On Android, uninstall thinky like any app.