Versioned and validated
The schema version, numeric ranges, string lengths, colour formats and identifiers are all checked before anything is accepted.
Privacy and safety
There is no network code in this application
Not “we do not collect data” — there is no client with which to collect it. No update check, no analytics, no crash reporting, no account, no licence server. The application works with a machine that has never been online.
What it reads
The application reads four things outside its own files, each only while the feature that needs it is in use:
| What | Why | When |
|---|---|---|
| Your display configuration | To place the overlay on the display you chose and to convert between physical pixels and window coordinates. | At startup, on monitor selection, and when Windows reports a display change. |
| Keyboard events for keys you configured | To switch crosshairs. Key codes are compared against your bindings and discarded. No key is ever logged, stored or sent. | Only while dynamic switching is enabled and the overlay is running. |
| The foreground window and its process name | For the optional per-application restriction, and for automatic profile detection if you enable it. Nothing is opened, injected or inspected beyond the process name. | Only while one of those optional features is enabled. |
| Your own data files | Settings, presets and profiles, from the application data folder. | At startup and when you change something. |
What it writes
Your data files, their backups and a rolling log. Nothing else, and nowhere else. No registry keys beyond what a normal user-level application writes for its own uninstall entry, and no files outside your profile.
| File | Contains | Notes |
|---|---|---|
settings.json | Preferences, shortcuts, overlay behaviour, dynamic switching bindings | Repaired on load if hand-edited into an invalid state; the original is kept as .bak |
presets.json | Your crosshair library | Built-in presets are re-seedable at any time |
profiles.json | Profiles, their crosshairs, displays and game associations | A broken entry is repaired rather than dropped where possible |
*.json.bak | The last known good copy of each file above | Used automatically when the primary file cannot be read |
logs/ | Rolling logs, one file per day | 1 MB per file, five files kept. No credentials exist to log. |
exports/ | Default location for exported crosshairs and libraries | Ordinary JSON you can read, diff and edit |
Logs contain no secrets, because there are none
There are no credentials, tokens, account identifiers or personal details in this product to log. Key presses are never logged, including the keys you have bound.
01Boundaries
What it will never do
These are not future features held back for a later release. They are the boundary of what this product is: a desktop window that draws a crosshair.
None of the following exists in the codebase, and none of it is planned. A build that added any of them would be a different product, and would no longer be safe to run beside the games this is meant for.
- Inject code into a game or any other process
- Read or write another process's memory
- Hook, patch or modify game files
- Bypass or interfere with anti-cheat software
- Generate synthetic keyboard or mouse input
- Automate gameplay in any way
- Install a kernel driver
- Request administrator rights
- Disable or weaken Windows security features
02Imported files
Imports are data, never instructions
Crosshair exports are JSON and are parsed as JSON. There is no script execution, no template evaluation, no path traversal and no command invocation anywhere in the import path.
Refused, with a reason
A malformed file is rejected with a readable explanation and changes nothing. Your existing library is not touched by a failed import.
New identifiers on import
Imported crosshairs always receive fresh identifiers, so an import can never overwrite a crosshair you already have.
03This website
The site you are reading
This is a static site: plain files, no server-side code, no database. It sets no cookies, runs no analytics, loads nothing from a third party, and the editor on the home page runs entirely in your browser — nothing you configure there is uploaded or stored.
| Item | Value |
|---|---|
| Cookies | None |
| Analytics or tracking | None |
| Third-party requests | None — the font is served from this origin |
| The home page editor | Client-side only. Nothing you configure is transmitted or saved. |
| Hosting | The static pages, plus the release download served from this site’s own object storage. Security headers are applied by the deployed Worker. |
| Contact for release data | %APPDATA%\crshX contains everything the application writes |