DA Privacy Kit v0.1.0b1

The first public beta of DA Privacy Kit, a desktop app that finds common privacy issues on a Linux
computer and, where it is safe, fixes them, with tools for your files, drives, browsing and apps beside it.
It says how much each finding matters on this machine, shows exactly what a fix will change before making
it, and can put it back. Scans are read-only and work fully offline.

Warning

Public beta: expect bugs, in what it detects, in what it tells you, and in what its fixes and tools do.
For now it is best used to scan, to learn about your own system and to try its tools: don't rely on it yet
for critical privacy matters. It isn't risk-free either: several fixes and tools run commands with
administrator rights, and a bug in one of those can affect the whole system. Keep backups.

It is no replacement for Tails or Qubes OS, it isn't
antivirus, and it doesn't make you anonymous online.

What it does

• Scans the machine, changing nothing. 125 checks of disk encryption and swap, logins and the screen
  lock, the network, browsers, telemetry, what the desktop and your apps record, sandboxing and updates.
  Nothing leaves the computer.
• Rates each finding for this machine. No disk encryption matters more on a laptop than on a virtual
  machine; a saved password matters less on an encrypted disk. What couldn't be checked is listed first,
  never passed over, and the caches and histories every computer has are listed apart, not counted.
• Fixes what it safely can. Every fix shows its dry run first: each setting, file and command. Changes
  are recorded and can be reverted from History; deleting caches and histories can't be undone, so each is
  confirmed on its own. Easy fixes… gathers the ones that cost you nothing, or next to nothing.
• Guides you through the rest, step by step for this machine, and explains, with the commands, what the
  app shouldn't do for you.
• Keeps track. Each scan says what is new, resolved or worse since the last one, and whether a fix has
  been undone. Scheduled scans notify only about those.
• Teaches. Every check says what leaks, to whom, and why its fix works, and every action the app takes
  is shown as the command that does it.

Tools you start yourself: Verify a download (the release keys of Linux Mint, Ubuntu, Debian, Fedora, Arch,
Tails, Qubes OS, Tor Browser and more built in), Remove metadata, a RAM disk, Tor or Mullvad Browser run from
memory in a sandbox, Try an app in a sandbox with decoy files, What does this app keep?, the TRIM test, Deleted
file names, Before you hand over a drive, Retire a drive, Before you travel, Presentation mode, and a live view
of the camera and microphone. Online tests (DNS leaks around a VPN, IPv6 going round it, ports the router
forwards and more) are separate and opt-in, and name every host they contact before anything runs.

Install

Download DAPrivacyKit-0.1.0b1-x86_64.AppImage, make it executable and run it:

chmod +x DAPrivacyKit-0.1.0b1-x86_64.AppImage
./DAPrivacyKit-0.1.0b1-x86_64.AppImage
./DAPrivacyKit-0.1.0b1-x86_64.AppImage --install-helper    # once, recommended: the administrator helper

It needs x86-64 Linux: Ubuntu 24.04 / Mint 22, Debian 13, or a current Fedora, Arch or CachyOS, with
WebKitGTK 4.1 for its window:

Distribution
Ubuntu, Mint, Debian	sudo apt install gir1.2-webkit2-4.1
Fedora	sudo dnf install webkit2gtk4.1
Arch, CachyOS	sudo pacman -S webkit2gtk-4.1

The app never runs as root: what needs it goes through a small helper that offers only named actions, and you
approve each session with your password. Installing the helper makes that prompt name the app rather than
python3.

The README says what it is; the
manual covers the rest.

Verify

The release is signed with the Digital Archon release key,
docs/release-key.asc, whose
fingerprint is:

3AA5 C061 33BB C05A 4151  EA41 5B59 48EB 785E D3AF

With the AppImage, its .asc and its .sha256 in one folder:

curl -sSfO https://raw.githubusercontent.com/DigitalArchon/DAPrivacyKit/v0.1.0b1/docs/release-key.asc
gpg --import release-key.asc
gpg --verify DAPrivacyKit-0.1.0b1-x86_64.AppImage.asc DAPrivacyKit-0.1.0b1-x86_64.AppImage
sha256sum -c DAPrivacyKit-0.1.0b1-x86_64.AppImage.sha256

gpg should say Good signature from "Digital Archon Release Signing", with the fingerprint above (its
warning that the key isn't certified is normal). From now on the app checks its own next release itself:
Verify a download in Tools says Verified: made by Digital Archon.

SHA-256: 9e7367773a99aab60c8fca81f67417e9533ad86620828e0735bcd0018ef00db8

The AppImage is reproducible: packaging/verify-release.sh v0.1.0b1 in a clone (rootless Podman) builds the
tag and compares the result with this release, byte for byte. See
packaging/README.md.

Known limitations

• Made for and tested on two desktops: Cinnamon (Linux Mint) and KDE Plasma 6. GNOME, Xfce and KDE
  Plasma 5 are not tested and not supported: the app has checks and fixes for them, but none have been tried
  on a real machine. If you use it there anyway, read each fix's dry run before applying it.
• Without administrator access some checks can't run (disk encryption key slots, the account password
  database, and others). They are listed as couldn't check, never as passed.
• It can't see what isn't on this computer: inside a virtual machine, the host's disk encryption; your
  router's settings beyond what the online tests show; what websites and services do with your data.
• Deleting is not erasing. On SSDs and copy-on-write filesystems, deleted data can stay readable; the app
  never claims to securely delete a file. Disk encryption is what protects deleted data, and the app tells you
  where you don't have it.
• On X11 the browser sandbox protects your files and network address, not the screen, unless you give
  the browser a display of its own (Xephyr, an option in the panel). On Wayland it depends on the compositor;
  the panel says what yours still lets the browser do.
• It never updates itself or checks for updates online. Once a copy is more than three months old, it
  says so at the top of the window, with the link to the releases page.
• x86-64 only. Internally, the command and folders are named daprivacyscanner.

Feedback

Bugs and ideas: issues, with a redacted report if it
helps (Export… with Redact ticked; read it first, since an issue is public). The app sends nothing by
itself, so we only hear of a bug from you. Security problems: please report privately as described in
SECURITY.md, not in an issue.

Licensed GPL-3.0-or-later.