FrostByte 1.0 Privacy Notice
FrostByte is provided by Blackfrost Softwares Corp, operating as Blackfrost AI/SI.
No analytics, automatic diagnostic reports or in-app feedback collection. FrostByte 1.0 has no reporting transport: it does not collect diagnostic counters for submission, send reports to the former backend or upload feedback. An earlier diagnostics opt-in cannot enable this retired functionality. Optional feedback opens GitHub without automatically attaching application data.
This is not a claim of anonymous or network-free operation. Local application state and device dashboards are needed to run the app. Transfers, approved connections, update checks and services you use still exchange ordinary network data.
1. What stays on your devices
FrostByte stores settings, destinations, catalog and library entries, hidden-entry choices, torrent metadata and identifiers, transfer progress, Hugging Face repository and file information, and saved device connection details so your session can resume. It stores your accepted notice versions and acceptance time locally. Previous acceptance records remain when notices change; their historical diagnostics choice cannot enable reporting.
Interface preferences live in the local application profile. Device dashboards read resource, storage and transfer measurements from this computer or an approved companion. These are displayed locally and are not submitted to Blackfrost AI/SI as analytics.
On macOS, Community records normally live under ~/Library/Application Support/frostbyte, with Electron interface data under ~/Library/Application Support/Frost/Byte. Windows uses %APPDATA%\\frostbyte and the edition’s Electron profile. Linux uses the configured application-data and interface profile directories. Founders uses a separate edition profile. Download destinations can be changed. Local filenames, paths, hostnames and transfer history are not all encrypted.
Operational logs may contain filenames, repository names, device information or paths. FrostByte 1.0 does not automatically submit logs, crash dumps, screenshots or recordings. Operating systems, dependencies and connected services may create their own records. Review anything you manually share with support.
2. Credentials and publisher identity
New saved Hugging Face tokens and pairing private SSH keys use Electron safeStorage with operating-system protection: Keychain-backed encryption on macOS, the Windows user’s DPAPI context on Windows, and an available supported credential store on Linux. FrostByte refuses new secret storage when secure encryption is unavailable or a plaintext backend is selected. This cannot protect secrets from a compromised account, system or software that already has authorized access.
FrostByte can retain Hugging Face account and token-role metadata. Older records may need migration; removing a token in Settings clears the app’s stored token fields. Revocation at Hugging Face is separate.
A companion-setup password is used in memory and is not saved as the reconnect credential. Approved pairing adds a public SSH key to the device and retains the matching protected private key locally. Saved details include addresses, username, port and trusted host identity. Existing SSH aliases use your existing configuration and credentials.
Publisher identity setup optionally stores a public key, display name, creation time, backup confirmation and protected private key locally. Its password and recovery phrase are not uploaded by setup. A recovery phrase restores the same key; protect it like a secret. Copying it can expose it to your clipboard or clipboard-history software. Removing the identity does not erase copies saved elsewhere.
Account changes, credential-store locking or app updates can affect stored-secret access. FrostByte preserves unavailable encrypted records for recovery instead of silently replacing them.
3. Transfer and discovery requests
Hugging Face: searches, filters, repository identifiers, revisions, filenames and downloads go to Hugging Face and its delivery infrastructure. Approved authenticated operations include your token. Providers receive the requesting device’s network address and ordinary request metadata.
BitTorrent: peers, trackers, DHT and enabled local discovery can receive IP addresses, ports, peer identifiers, torrent infohashes, transfer information and shared pieces. Downloads can upload and continue seeding.
IPFS: previewing or retrieving a CID exposes requested content identifiers and connection information to relevant participants. Explicitly shared content is served from a separate publishing cache. Files, verification records, history and caches remain on the transferring device until cleared. Clearing history or cache does not automatically delete completed downloads.
Catalogs and publication: importing a catalog contacts its host. Exporting magnets or CSVs creates content identifiers or metadata for you to save or share. Publication is a separate explicit action; review what will be sent and where. Public data you share can be copied and cannot necessarily be recalled.
Local and overlay discovery: approved network checks communicate with selected addresses and can read service greetings. Adding an existing WireGuard overlay records its discovery selection locally; it does not read or copy WireGuard private keys or change routes. Operating-system routing determines actual connectivity. Enabled port mapping communicates with your router.
Requests originate from the device doing the work: the desktop for local transfers or the companion for remote transfers. FrostByte does not hide that address or guarantee anonymity.
4. Connected devices and optional model services
Approved SSH or paired connections exchange device capabilities, folder paths, storage status, transfer commands and results. A companion can read and write registered storage folders and retains transfer and inventory state there. Authenticated Hugging Face downloads can send the approved token to that companion for the job; current companion download records do not persist it.
Companions can continue after the desktop disconnects or is removed. Device administrators and sufficiently privileged software can access that device’s state and files. Removing a desktop profile does not uninstall remote software or remove its authorized SSH key.
AEON capabilities and console links arrive over an approved connection. Opening a console contacts the device in your browser and uses its own login. Changing the appearance does not grant access or send analytics.
Where your edition provides Studio or model-service connections, prompts, selected context, messages and approved tool results go to the local or remote model endpoint you choose. Conversations and project state may be saved locally. Provider authentication and data policies apply to that endpoint. These functional exchanges are not FrostByte analytics.
5. Update checks, links and optional GitHub feedback
Enabled automatic update checking and manual checks request public release metadata from Blackfrost AI/SI’s update service. Requests do not attach library history, model identifiers, credentials or an installation identifier. Hosting infrastructure receives ordinary metadata such as the network address and time. You can disable automatic checks in Settings. Founders does not use the public Community updater.
Selecting feedback opens the official GitHub issue page in your browser with no prefilled report, diagnostics, logs, filenames, token or account data from FrostByte. GitHub receives the browser request under its own privacy policy. You decide whether to sign in, write and submit an issue. Public repository issues can be visible to everyone; do not include secrets or sensitive data. FrostByte cannot erase copies others make.
Other links open their destination in your browser under its operator’s policies. Contacting support sends the address and content you choose to provide. Declining feedback does not reduce functionality.
6. Website delivery and earlier releases
This notice describes the v1.0 app. Download websites, GitHub, cloud storage and service infrastructure can process IP addresses, user agents, URLs, timestamps, response information, session cookies and security records under their displayed policies. No app analytics or report collection does not mean those services receive no network requests.
Installing v1.0 stops the retired reporting path; it does not delete reports already submitted by older versions, support correspondence or independent service logs. Contact support about records previously submitted to Blackfrost AI/SI. This update does not silently change website retention settings or erase server-side records.
7. Retention and choices
Local records remain until cleared or removed. Removing transfers, hiding entries, uninstalling the desktop or clearing IPFS caches does not necessarily delete completed files, settings, backups or companion state. File deletion has a separate explicit review.
You may remove a saved Hugging Face token, revoke it with its provider, retire an authorized SSH key, disconnect a companion, disable automatic update checks or pause/stop sharing. Verify the affected device and file scope. Previous sharing cannot be recalled from independent peers.
Where applicable, you may have rights to information, access, correction, deletion, restriction, objection or other remedies regarding personal data we control. Contact support to make a request. Proportionate verification may be needed. We cannot directly erase records on your devices or independently operated peers and services.
8. Contact and changes
Contact Blackfrost Softwares Corp, operating as Blackfrost AI/SI, at support@blackfrostai.com without sending secrets. Material changes to app data handling will be reflected in versioned notices and presented for review.
Website download delivery — October 13, 2026
Community 1.0 download pages and buttons require no invite, account, email, terms-acceptance record or download-session cookie. An old /frostbyte/access bookmark redirects to downloads and clears a legacy browser cookie. Historical beta sessions expire separately and are not needed for current downloads.
The service checks an allowlisted release file, byte count, checksum metadata and storage generation before issuing a Google Cloud Storage link valid for at most 10 minutes. The bucket remains private; a temporary URL grants access only to that release object. Share the official download page, not the expiring link.
To prevent abuse, download requests use hashed network identifiers and request counts in 15-minute windows, with per-network and global limits. These records are marked for deletion after 24 hours; cleanup is asynchronous. No separate per-download authorization audit record, account or app usage profile is created by this flow.
Firebase and Google Cloud hosting, security and delivery infrastructure can process or log network addresses, user agents, URLs, timestamps, response codes and delivery details. These are ordinary website operations, not FrostByte 1.0 app analytics. See the main website privacy policy for wider site practices.
Older beta clients may still use their original optional reporting service. Existing diagnostic records have a 30-day deletion target and feedback a 90-day target; cleanup is asynchronous. Earlier session records are marked for deletion at expiry. This release does not delete historical reports, support correspondence, operational logs or backups. Contact support about previously submitted records. FrostByte 1.0 never sends reports to that service, even if an earlier version was opted in.