Overcut Trust Center
Transparency for your PC. Everything Overcut Connector does - and doesn't do.
What the Connector Does
- •Reads simulator telemetry from shared memory or UDP packets on your PC.
- •Serves a local WebSocket dashboard at 127.0.0.1:9000 (loopback by default).
- •Streams your live telemetry to your dashboard over an encrypted connection. It is not stored.
- •While "Record sessions" is on, writes session files to ~/.overcut/ on your PC and saves a private copy of each finished session to your account. While it is off, nothing new is recorded.
What the Connector Does NOT Do
- •Does not sell your telemetry or share it with third parties for their own purposes.
- •Does not read files outside of simulator shared memory or UDP.
- •Does not run at system startup unless you configure it to.
- •Does not modify any game files.
Installer Verification
Windows Security
- •Overcut Connector is code-signed with a verified Individual Validation certificate.
- •Windows UAC shows the verified publisher name instead of 'Unknown publisher'.
- •Every signed file carries an RFC-3161 timestamp so the signature stays valid after certificate renewal.
- •SmartScreen reputation builds with download volume. Clearance improves with each release cycle.
If Windows still shows a SmartScreen prompt on an early build, click 'More info' then 'Run anyway'. This is normal for newly signed software before sufficient download history has been gathered.
Upgrading from the Alpha Build
The signed public preview (v0.2.0-public-preview) is the first release with a verified Overcut publisher certificate. Windows cannot auto-apply an update when the publisher identity changes, so users on the unsigned alpha build (v0.1.0-alpha) must download and run the new installer manually. The alpha build remains safe to use until you are ready to upgrade.
Privacy
Your live telemetry is streamed to the screens where you are signed in, over an encrypted connection, and it is not stored while it streams. Sessions recorded by the Connector are saved to your account, private to you unless you share them, and you can turn recording off or delete the copies at any time. Community data is on by default and you can turn it off in your account: eligible driving data may be used in grouped results, never shown for fewer than 8 distinct accounts. Anything else is opt-in: diagnostic data, cohort benchmarks (anonymized lap summaries) and coach view. The full terms are in our Privacy Policy.
Why an installer asks for this much trust
Overcut Connector is a desktop executable that runs on the PC you race on. That is a meaningful thing to hand over, and no amount of reassuring copy substitutes for something you can check yourself. So everything needed to check it is published: the exact filename, the SHA-256 of the file we built, the signing certificate it carries, and an independent scan you can open without taking our word for any of it.
None of this depends on trusting the page you are reading. A hash you compute on your own machine either matches the published one or it does not.
What a signature proves, and what it does not
A code signature proves two narrow things: the file came from the holder of that certificate, and it has not been altered since it was signed. It is an identity and integrity check.
It does not prove the software is well written, safe, or doing what it claims. No signature can. That is why this page also spells out what the Connector touches on your PC and what it sends off it, and why the source of those claims is a privacy policy you can hold us to rather than a badge.
Verifying the download by hand
The check above compares hashes for you, but it is not the only way and you should not have to rely on it. Open PowerShell in the folder you downloaded to and run Get-FileHash against the installer, selecting SHA256 as the algorithm. Compare what it prints against the hash published on this page and in the checksums file attached to the release.
If the two differ, do not run the file. A mismatch means the download was corrupted or the file is not the one we published, and neither is worth the risk of finding out which.
Why Windows may warn you anyway
Windows SmartScreen weighs how many people have already installed a given file. A new release from a small publisher has no such history, so it can be flagged regardless of whether it is signed. The warning is about reputation, not about detection: it is not a claim that anything malicious was found.
That reputation accrues on its own as installs add up. In the meantime the honest answer is to verify the hash before running the installer, which is a stronger check than the prompt you are clicking through.
What leaves your PC
While you drive, the Connector streams your telemetry over an encrypted connection so your dashboard can show it on the screens where you are signed in. It is delivered live and is not stored on our servers.
Sessions recorded by the Connector are saved to your account by default, and only you can see them, unless you share them. You can stop recording with the "Record sessions" switch and delete the saved copies at any time. Community data is on by default and you can turn it off in your account: eligible driving data may be used in grouped results, never shown for fewer than 8 distinct accounts. Everything else is either required to sign in or something you switch on: your account credentials, cohort benchmarks (anonymized lap summaries, opt-in), coach view (someone you choose sees your data), and diagnostics or crash reports (opt-in, asked for separately).
The Connector listens on your own machine by default. Exposing it to the rest of your network is a deliberate setting, and when it is on the connection requires a token, so being on the same Wi-Fi is not by itself enough to reach it.