Overcut Trust Center
Transparency for your PC. Everything Overcut Connector does - and doesn't do.
What the Connector Does
- •Reads simulator telemetry from shared memory or UDP packets on your PC.
- •Serves a local WebSocket dashboard at 127.0.0.1:9000 (loopback by default).
- •Optionally relays dashboard sessions via Cloudflare conduit (encrypted in transit, zero raw telemetry persisted).
- •Writes session metadata to ~/.overcut/ (local only, never uploaded automatically).
What the Connector Does NOT Do
- •Does not upload raw telemetry frames to Overcut servers.
- •Does not read files outside of simulator shared memory or UDP.
- •Does not run at system startup unless you configure it to.
- •Does not modify any game files.
Installer Verification
Windows Security
- •Overcut Connector is code-signed with a verified Individual Validation certificate.
- •Windows UAC shows the verified publisher name instead of 'Unknown publisher'.
- •Every signed file carries an RFC-3161 timestamp so the signature stays valid after certificate renewal.
- •SmartScreen reputation builds with download volume. Clearance improves with each release cycle.
If Windows still shows a SmartScreen prompt on an early build, click 'More info' then 'Run anyway'. This is normal for newly signed software before sufficient download history has been gathered.
Upgrading from the Alpha Build
The signed public preview (v0.2.0-public-preview) is the first release with a verified Overcut publisher certificate. Windows cannot auto-apply an update when the publisher identity changes, so users on the unsigned alpha build (v0.1.0-alpha) must download and run the new installer manually. The alpha build remains safe to use until you are ready to upgrade.
Privacy
Nothing leaves your PC unless you turn it on. Telemetry is processed locally and your session files stay on your machine. The exceptions are all opt-in: diagnostic data, cohort benchmarks (anonymized lap summaries), and live coach view, which forwards frames through a relay that passes them on without recording them. The full terms are in our Privacy Policy.
Why an installer asks for this much trust
Overcut Connector is a desktop executable that runs on the PC you race on. That is a meaningful thing to hand over, and no amount of reassuring copy substitutes for something you can check yourself. So everything needed to check it is published: the exact filename, the SHA-256 of the file we built, the signing certificate it carries, and an independent scan you can open without taking our word for any of it.
None of this depends on trusting the page you are reading. A hash you compute on your own machine either matches the published one or it does not.
What a signature proves, and what it does not
A code signature proves two narrow things: the file came from the holder of that certificate, and it has not been altered since it was signed. It is an identity and integrity check.
It does not prove the software is well written, safe, or doing what it claims. No signature can. That is why this page also spells out what the Connector touches on your PC and what it sends off it, and why the source of those claims is a privacy policy you can hold us to rather than a badge.
Verifying the download by hand
The check above compares hashes for you, but it is not the only way and you should not have to rely on it. Open PowerShell in the folder you downloaded to and run Get-FileHash against the installer, selecting SHA256 as the algorithm. Compare what it prints against the hash published on this page and in the checksums file attached to the release.
If the two differ, do not run the file. A mismatch means the download was corrupted or the file is not the one we published, and neither is worth the risk of finding out which.
Why Windows may warn you anyway
Windows SmartScreen weighs how many people have already installed a given file. A new release from a small publisher has no such history, so it can be flagged regardless of whether it is signed. The warning is about reputation, not about detection: it is not a claim that anything malicious was found.
That reputation accrues on its own as installs add up. In the meantime the honest answer is to verify the hash before running the installer, which is a stronger check than the prompt you are clicking through.
What actually leaves your PC
Telemetry is processed on your machine and your session files are written there. Reading a lap, replaying it, and analysing it are local operations, which is why they keep working when your connection does not.
Some things do cross the network, and each is either required to sign in or is something you switch on: your account credentials, cohort benchmarks (anonymized lap summaries, opt-in), live coach view (a relay that forwards frames to whoever holds your link while you drive, without recording them), and diagnostics or crash reports (opt-in, asked for separately).
The Connector listens on your own machine by default. Exposing it to the rest of your network is a deliberate setting, and when it is on the connection requires a token, so being on the same Wi-Fi is not by itself enough to reach it.