Privacy Policy

Summary

RPCortex is open-source software that runs locally on your own microcontroller. By itself it is offline and collects no personal data and sends nothing to us. It contacts the internet only when you run a feature that needs to (an update check, the package manager, time sync, or an app you install), and in those cases your device talks directly to the relevant service — the data does not pass through us.

This website (rpc.novalabs.app) uses no cookies, no analytics, no advertising, and no tracking scripts.

Scope

This policy covers two things:

• This website — rpc.novalabs.app and its pages (docs, packages, install, update, etc.).
• The RPCortex operating system — the firmware you flash onto a supported microcontroller (RP2040 / RP2350 / ESP32-S3).

It is published by dash1101 (“we”, “us”), based in the United States of America. RPCortex is proprietary, source-available software — © 2026 dash1101, all rights reserved. The source is public on GitHub to read and study, but reuse requires written permission; see the LICENSE.

This website

• Hosting. The site is served as static files by GitHub Pages. Like any web host, GitHub may record standard server request data (such as your IP address and browser user-agent) in its own logs; that processing is governed by GitHub’s privacy statement, not by us.
• No cookies or analytics. We set no cookies and load no analytics or advertising scripts. The only thing stored in your browser is a small flag in sessionStorage (which clears when you close the tab) so an announcement banner you’ve dismissed doesn’t reappear during your visit — it is not a cookie, is never sent to us, and tells us nothing about you.
• Install / Update pages (Web Serial). Flashing uses your browser’s Web Serial API to talk to a device you physically plug in. That communication is strictly between your browser and your board — firmware files are sent to the device locally and are not transmitted to us.
• Packages page. To list available packages, your browser fetches the package index and package files from GitHub (raw.githubusercontent.com). No data about you is sent beyond the normal request.
• Outbound links. Pages link to GitHub, Discord, and similar services that have their own privacy policies.

The RPCortex OS

The operating system runs entirely on your device and is offline by default. It contains no telemetry and does not “phone home.” It only reaches the network when you run a command or app that explicitly does so (see Network features below).

Data stored on your device

RPCortex keeps the following only on the device’s own flash storage. None of it is sent to us.

• User accounts. Usernames and salted SHA-256 password hashes (passwords are not stored in reversible form) in /Vela/Registry/user.cfg.
• Wi-Fi credentials — stored in plaintext. Saved Wi-Fi network names and passwords are written unencrypted to /Vela/Registry/networks.cfg. Microcontrollers generally have no secure enclave, so this is a hardware limitation: anyone with physical access to the flash can read them. Treat the device like a key.
• Settings & personalization. Device name, owner name, timezone, and preferences in the local registry.
• Logs. A local activity log (/Vela/Logs/) for diagnostics, stored on-device only.

Network features & third parties

These features reach the internet only when you invoke them. In every case your device connects directly to the service; we do not sit in the middle and do not receive your data. Each third party has its own privacy policy.

• Over-the-air updates (update check / update online) — downloads a version manifest and OS image from the RPCortex update host (rpc.novalabs.app, served by GitHub Pages). Standard server logs (e.g. IP, user-agent) may be recorded by the host.
• Package manager (pkg) — downloads the package index and packages from GitHub.
• Time sync (ntp sync) — contacts an NTP time server. The optional ntp sync --auto additionally sends your public IP address to ip-api.com to estimate your timezone. This is off by default.
• Web search (optional websearch package) — sends your query to DuckDuckGo and Wikipedia.
• AI assistant (optional ask package) — sends your prompts to whatever AI backend you configure (for example a local or remote Ollama server). Your prompts go to that endpoint; choose one you trust.
• General networking (wget, curl, ping, runurl) — contact whatever hosts you point them at. runurl downloads and runs code and asks for confirmation first.
• Built-in web server (optional httpd package) — serves pages/files from your device to other clients on your network. It hides known credential files, but when file browsing is enabled it exposes the rest of the filesystem read-only — run it only on networks you trust.

What we do not collect

• No analytics, no telemetry, no usage tracking.
• No user accounts on our servers — accounts exist only on your device.
• No advertising and no third-party ad/tracking networks.
• We do not sell, rent, or share personal data — we don’t collect it to begin with.

Security

• Account passwords are salted and hashed (SHA-256) on the device; they are not stored or transmitted in plaintext.
• Wi-Fi passwords are stored in plaintext on the device (see above) — a hardware constraint, not a choice. Physical possession of the board means access to those credentials.
• No system is perfectly secure. For a device left on an untrusted network, disable the web server’s file browser and avoid storing secrets you can’t afford to expose.

Third-party services

Depending on which features you use, your device or browser may interact with:

• GitHub / GitHub Pages — site hosting, OS images, package downloads.
• ip-api.com — IP geolocation, only with ntp sync --auto.
• DuckDuckGo and Wikipedia / Wikimedia — the websearch package.
• Your chosen AI backend (e.g. Ollama) — the ask package.
• Public NTP servers — time sync.

We are not responsible for the practices of these services; review their policies.

Children’s privacy

RPCortex is a developer/maker tool and is not directed at children under 13. We do not knowingly collect personal information from children.

Changes to this policy

We may update this policy as the software and website evolve. Material changes will be reflected by the “Last updated” date at the top of this page.

Contact

Questions about privacy or this policy can be raised via GitHub Issues, or by emailing support@novalabs.app (dash1101, United States of America).