Privacy Principles & Local-First Architecture
Hardware control should never require surrendering your personal privacy.
Modern vendor control utilities often require mandatory account registration, continuous background telemetry, and cloud synchronization just to adjust a fan curve or change a keyboard backlight color. Arsenal rejects this design pattern entirely.
No Accounts or Profiling
There is no sign-up form, username, password, or cloud profile. You never provide your name, email, or credentials to use Arsenal.
Zero Analytics SDKs
Neither the Windows desktop application nor the Android companion bundles Google Analytics, Firebase, Sentry, Mixpanel, or any telemetry library.
100% Local Processing
Hardware enumeration, sensor polling, fan curve interpolation, and power limit adjustments execute entirely on your machine's CPU.
No Monetization of Data
We do not collect, aggregate, analyze, sell, or license user telemetry or device information to advertisers or data brokers.
Windows Application Network Audit
Complete technical audit of every outbound connection made by the desktop software.
To maintain complete transparency, the table below documents every network connection that Arsenal for Windows is capable of initiating:
| Connection Type | Destination | Data Transmitted | Frequency & Trigger | User Control |
|---|---|---|---|---|
| Signed Update Check | get-arsenal.com |
None. A clean HTTP GET request. No hardware IDs, no MAC address, no serial number, and no username. | At application startup, or upon manual click in Settings → Updates. | Can be toggled off entirely in Settings → Updates. |
| ASUS Driver Discovery | Official ASUS Support (rog.asus.com) |
Laptop model string only (e.g. GA402RJ), required to query ASUS's driver catalog.
|
Only when you navigate to the Drivers & Updates tab. | Only triggered by explicit user action in the Drivers interface. |
| ASUS Driver Package Download | Official ASUS CDN (dlcdnets.asus.com) |
Standard HTTP download request for the selected installer archive. | Only when you explicitly click to download an ASUS driver. | User-initiated only. Download travels directly between you and ASUS. |
| ASUS Display Color Profiles | Official ASUS CDN (dlcdnets.asus.com) |
Model identifier to retrieve the official GameVisual ICC color profile. | Only when you choose to download ASUS display profiles in Settings. | User-initiated only. |
| AniMe Matrix Fonts | Official ASUS CDN (dlcdnets.asus.com) |
File identifier for the official ASUS AniMe Matrix font archive. | Only when you choose to install the optional font package in Lighting. | User-initiated only. |
Verify It Yourself in the Source Code
You do not have to take this audit on trust.
The entire update mechanism is implemented in ReleaseFeedClient.cs, which is concise and straightforward to review.
Routine hardware monitoring and tuning operations generate zero network traffic.
Mobile Companion & Local Network Architecture
Direct communication between your paired phone and PC on a reachable local network.
Arsenal Companion for Android enables live monitoring, hardware adjustments and optional remote desktop sessions from your phone. Its architecture is strictly private:
Private Local Network (LAN) Only
- Direct connection: Phone and PC communicate across a reachable local network; the PC may be on Ethernet.
- Zero cloud relays: Traffic never passes through an Arsenal cloud server, proxy, or relay service.
- No internet required for the local session: The phone and PC can still communicate while both remain reachable on the same local network.
Cryptographic Pairing
- Pairing QR code: The PC displays its address, port, temporary pairing code and TLS certificate fingerprint. The code expires after five minutes or one use.
- Authenticated connection: The phone pins the PC's TLS identity and receives its own credential. Later HTTPS connections must present that device credential.
Remote sessions and Android access
The Android manifest declares internet, network-state and Wi-Fi-state access. Pairing can use an on-device QR scanner. The current apps also include optional remote desktop access:
- PC consent: Remote desktop is a separate Windows switch. A session normally asks on the PC and expires if nobody answers. Unattended access is an explicit choice.
- Screen and input: During an approved session, the PC sends screen frames to the paired phone. Keyboard and mouse access can be disabled for view-only use.
- Optional channels: Separate Windows switches govern PC sound, text clipboard and file transfer. These move across the direct paired connection when enabled; Arsenal does not relay them through its website.
Local Data Storage & Files
All configuration and diagnostic data remains on your local filesystem.
Arsenal keeps normal settings and logs under %AppData%\Arsenal. Portable configuration may sit beside the executable. The companion certificate identity is under %LocalAppData%\Arsenal\Companion, and a restricted configuration copy for the charge task can be under %ProgramData%\Arsenal.
config.json
Contains saved performance plans, fan curves, power limits and layouts. Device credentials are protected for your Windows account; the shared ProgramData copy omits their private keys. Configuration is not uploaded to an Arsenal service.
log.txt
Local operational log recording detected hardware models, ASUS ACPI initialization responses, and runtime events. Kept strictly on local disk for personal troubleshooting. It is never transmitted automatically.
Complete Data Removal
Quit Arsenal, remove its Windows sign-in and optional charge-limit tasks, revoke paired devices and remove the companion firewall rules if you enabled them. Then delete the executable and the saved-data locations above. The removal guide lists the steps.
Website Data Practices (get-arsenal.com)
No analytics, no advertising beacons, and no tracking cookies.
Visiting get-arsenal.com does not subject you to commercial surveillance:
- No advertising or tracking cookies: We do not set cookies on visitors to public pages. Consequently, you will never see an annoying cookie consent banner.
- Self-hosted assets: Fonts (Inter and JetBrains Mono) and JavaScript libraries are hosted directly on our servers. Your browser makes zero requests to Google Fonts or third-party script CDNs.
- Local storage usage: A single flag is stored in your browser's local storage solely to remember whether you have dismissed the creator note modal. This value never leaves your browser.
- Admin session cookie: A single secure session cookie (
arsenal_session) exists exclusively on/adminto keep the site operator authenticated. Regular visitors never encounter it.
Web Server Access Logs
Like all standard web servers, our hosting infrastructure automatically maintains operational access logs. These logs record standard HTTP metadata:
- Client IP address
- Date and time of the request
- Requested URL / resource path
- HTTP status code returned
- Browser User-Agent header and Referrer header (if provided)
Retention and Purpose: Server logs are retained for a maximum of 30 days. They are used strictly to diagnose technical server faults, analyze error rates, and defend against denial-of-service (DDoS) attacks. They are never linked with individual identities, sold, or shared with third parties.
Regulatory Rights & Contact
Your rights under European, UK, and international privacy regulations.
GDPR & UK GDPR Compliance
Under the General Data Protection Regulation (GDPR) and UK GDPR:
- Lawful Basis: The processing of transient web server access logs is based on Legitimate Interests (Article 6(1)(f) GDPR) in operating a secure, reliable, and fault-tolerant web server. User-initiated package downloads are processed based on the performance of a requested action.
- Data Subject Rights: You have the right to request access to or erasure of any personal data we hold about you. Because Arsenal requires no accounts and collects no identifying information, the only potentially identifiable data is a short-lived IP address in transient server logs.
If you have any questions regarding data handling or wish to exercise your data protection rights, please contact our dedicated privacy inbox.