What Tree protects
A TDF is a file on your computer. You can keep it private, include it in your backups, send it to selected people, or publish it. Creating a TDF does not publish it.
Password protection controls who can open the saved file. It encrypts the whole TDF. Use a long password that you do not reuse, and give it through a different trusted channel when you share with selected people. Once someone opens the file, they can read and copy its contents. Grower and Player also need a decrypted working copy while the file is open, so protect your computer account and disk too.
A signature answers whether the archive changed. It does not hide the archive, prove that an unknown signing key belongs to a particular person, or make captured web code safe.
Automatic privacy detection is intentionally limited. Grower preserves captured web addresses, response headers, pages, scripts, images and data files for replay. Privacy Review can warn when limited header-name checks suggest signed-in activity, but it does not remove private values. Sign out before capture, and review archives carefully before sharing; private information may be present even when it was not visible on the rendered page.
Player serves archived HTTP responses without using the original sites as a fallback. This limit applies to intercepted HTTP traffic. WebSocket and WebRTC traffic is outside the current capture and replay model.
Report a vulnerability
Email support@dosaygo.com with the subject “TDF security report.” Please do not publish an unpatched vulnerability or attach a private TDF to a public issue.
What to include
- Affected Tree Player or Tree Grower version and operating system.
- Whether the issue affects Grower, Player, the archive format, licensing, an installer, or the website.
- Clear reproduction steps, expected behavior, and observed behavior.
- Minimum proof-of-concept material needed to reproduce the issue.
- Logs with tokens, cookies, URLs, personal data, and captured bodies removed.
Archive handling
Do not email an authenticated or private TDF unless support explicitly requests it and agrees on a secure transfer method. Create a minimal synthetic reproduction whenever possible.
Optional password protection protects a saved file at rest and while it is being transferred. It is useful for private storage, backups and sharing with a limited group. It does not remove information from the archive. Once decrypted or opened, the recipient can access the contained data.
Verify releases
Download stable artifacts from the TDF site or the public release mirror. Verify the archive against SHA256SUMS.txt before manual installation.