Safety & privacy

Check it yourself.

Krayton is a new, independent app made by Oussama Hadji. The current Windows and macOS downloads have no verified publisher certificate, so your computer may show a warning. Here is what that means, what Krayton sends over the network, and how to verify your download in a minute.

Why the warning What leaves your computer Verify your download ← Back to the install steps

The warning

Why Windows or macOS may show a warning.

What it means

The current builds have no verified publisher certificate: Windows cannot verify the publisher, and the macOS app has not been signed with an Apple Developer ID or notarized by Apple. SmartScreen or Gatekeeper may warn you or block the first launch.

Unsigned software has not passed these publisher checks. Only continue if you trust the source and are comfortable installing this build.

Read the exact warning

An unrecognized-publisher prompt means Windows or macOS cannot verify this publisher. Read the exact message: SmartScreen also considers file reputation. A checksum lets you compare your download with our published bytes; it does not establish that the software is safe.

If antivirus names a threat, or macOS says the app is damaged or will damage your computer, stop and contact support with the exact message. Keep your security protections enabled.

Read the official explanations: Microsoft's SmartScreen and Apple's guidance.

Privacy

What Krayton sends, and what it never does.

Every request from the app to our server, listed. Krayton's own code makes no other calls to it.

Privacy

Your code stays on your computer.

Krayton does not upload your code, chats, files or API keys. Here is where each thing actually goes.

1
Stays on your computerYour code, chats and API keys are never uploaded to Krayton.
2
Agents talk to their own providersThrough the CLIs and logins you already have. Krayton is not in the middle.
3
Only sign-in reaches usYour email, a subscription check, and a one-way hash of your computer's ID that enforces the three-computer limit. The raw ID never leaves your machine.

Every request to our server

WhenWhat is sentWhy

You create an accountYour email and password, plus a one-way hash of your computer's IDTo create your account

You confirm your emailThe code you were sentTo verify it is your address

You sign inYour email and password, plus the one-way hashTo start a session (Google sign-in happens in your browser)

While the app runsYour session token and the one-way hashTo check your subscription and receive a signed license, verified offline on this computer

You sign outA sign-out requestTo end the session

Never sent to us: your code, files, chats, prompts or API keys. The hash is a SHA-256 of your computer's ID; only the hash leaves your computer, and it limits one license to three computers.

Other connections you may see

WhereWhy

Your agent's provider (Anthropic, OpenAI, xAI, DeepSeek, Google…)The agent CLIs you installed talk to their own providers with your own logins. Krayton is not in the middle.

downloads.claude.ai, opencode.ai, registry.npmjs.orgA read-only check of the latest published version of the agent CLIs you have. It only compares version numbers and never installs anything in the background; updating is always your action.

Paddle (in your browser)When you choose to subscribe, checkout opens in your browser. Paddle shows your total and any tax before you pay.

Verify

Check the file before you run it.

A checksum proves the file on your disk is exactly the one we published.

Verify

Check the download before you run it.

Every installer has a published SHA-256 checksum. If yours matches, it is exactly the file we built.

1
Get the checksumWe publish one for every installer in SHA256SUMS.
2
Hash your fileOne command in a terminal. Nothing is uploaded; it runs on your computer.
3
CompareSame characters means an untouched file. You can also upload it to VirusTotal and scan it with dozens of engines.

Windows (PowerShell)certutil -hashfile kra-Setup.exe SHA256

macOS (Terminal)shasum -a 256 kra-mac-arm64.zip

Linux (terminal)sha256sum kra-linux-x86_64.AppImage

Only sign-in, account and license requests go to our server. Nothing else in the app talks to it.
No analytics or tracking libraries. Krayton's runtime dependencies are fonts, a terminal emulator and a pseudo-terminal library.
Your agents keep their own logins. Claude, Codex and the others are reached through the CLIs you installed, with your accounts.
See it for yourself. Any network monitor (Little Snitch, Resource Monitor, Wireshark) will show the same short list.

Something different on your screen?

If you see a malware detection, a damaged-app message, or an unexpected file name, stop and contact kraytonsoftware@gmail.com. Include your operating system and a screenshot of the message. Never send passwords or payment details.

← Back to the install steps