Privacy policy

Dust — CW Morse trainer
Android package dev.dust.morse
Effective date: 4 November 2026

This policy covers the Dust app on Android and iPhone, and the same program on the web at mashu.github.io/dust and on desktop: Linux, Windows and macOS. It describes what the app stores, where, what leaves the device, and who receives it.

The short version

Dust stores your practice on the device you are using. It has no account and no server of its own, and it sends your practice nowhere unless you turn on sync: then it keeps a copy in your own Google Drive, encrypted on the device with a passphrase only you know, which Google cannot read and the developer never receives. The app asks Google for its typefaces, and the web app is served by GitHub. A phone’s own backup, when it is on, copies the app’s data to your Google or iCloud account, as it does for other apps. In a browser, the other sites the developer publishes at mashu.github.io share the storage Dust keeps it in.

Who publishes Dust

Dust is an open-source Morse trainer. The source and this policy are published at github.com/mashu/dust. There is no account system, and the developer does not receive your practice history.

What the app stores on your device

Dust stores the following on the device so practice can continue the next time you open it:

• Settings. Speed, character set and any word list you add to it, session length, keyer, tone, band conditions, theme, and whether the guided setup has been opened, so it opens by itself only the first time. In Contest mode, also your callsign and the exchange you send.
• Practice history. For each session: the date and time, the groups that were sent, the characters you typed and how soon after each character's sound you keyed it, with the delay your audio device reports, accuracy, scores, speed, and per-letter results. For a contest run, also its log of QSOs and your country, continent and CQ zone. Every session is kept until you delete it; a browser keeps them while it gives this site room, and the app says when it has none.
• Sessions you deleted. For each one, when it finished, on what day, and when you deleted it, and nothing else of it. These notes are kept for good, so that another window or tab of Dust, or a copy of the app left open on the history from before, never brings a deleted session back.
• Level counters. Counts used to decide when to raise or lower the level you are practising.
• Sync, if you turn it on. A name for this device, made at random; the key the synced copy is encrypted with, and never your passphrase; notes of what this device has read from your Google Drive and sent to it; and, in the desktop app, what Google gives it to sign in again without asking you. Turning sync off deletes all of it from the device.
• A session in progress. While a session or contest run is running, when it started and what it has done so far: the groups answered, with the same details the practice history keeps, and the settings the session runs on, or for a contest run its log of the QSOs worked. If the app closes under it, Dust keeps that part in the practice history the next time it opens, and says so. It is removed when the session ends, or once it has been kept.

In Contest mode, Dust keeps your callsign and the exchange you send (name, state or province, CQ zone, class, section, power) in its settings on this device. Each contest run keeps only your country, continent and CQ zone, so its score can be worked out again. Both are in any backup you save, and, if you turn on sync, in the encrypted copy in your Google Drive. Dust sends them nowhere else. Clear Your station to remove them. The stations you work are generated by Dust; if one matches a real station, that is chance.

Dust does not use any of it for advertising, and it does not send it to the developer. Where it is kept, and what else may keep a copy, depends on where you run Dust:

• On Android all of this is kept in storage that only the app can read. If backup is on in Android settings, Android copies it to your Google account, as it does for most apps, and puts it back on a new phone or when Dust is installed again. Uninstalling the app deletes it from the phone, but not that copy. Turning backup off in Android settings stops it. This is Android’s own backup, not a feature of Dust: the copy is in your Google account, the developer never receives it, and Google holds it under Google’s privacy policy. Setting up a new phone straight from the old one can copy it across too. Turning off backup in Android settings stops the copy to your Google account, for every app at once.
• On an iPhone all of this is kept in storage that only the app can read. iCloud Backup, and a backup of the iPhone on a computer, copy it as they do for other apps, and restoring such a backup puts it back. Deleting the app deletes it from the iPhone, but not those copies. Those are Apple’s backups, not a feature of Dust, and the developer never receives them. In the iPhone’s iCloud settings, iCloud Backup can be turned off for Dust alone.
• In a browser all of this is kept in the storage of the site mashu.github.io, which every other site the developer publishes there shares: such a site could read it or clear it. Clearing the site data for mashu.github.io deletes it, along with what those sites keep. A browser keeps storage for a whole site, not for each page under it, and every project the developer publishes on GitHub Pages is a page under mashu.github.io. Only the developer’s GitHub repositories can publish there, and whatever a page there loads shares its access. Dust keeps the practice history in the browser’s database for the site (IndexedDB), in one named dust_history, and the rest in the site’s page storage (localStorage). It keeps everything under names that begin with dust_, and never touches anything else the site keeps. The room the browser gives the site is shared too: where other pages fill it, new sessions wait to be saved until there is room, and the app says so. Where a browser will not open its database for Dust, as some will not in a private window, that visit keeps the history in the browser’s small page storage instead, as earlier versions of Dust did: that has room for only the newest sessions, and lets older ones go as it fills. The app says so whenever that happens, and leaves the sessions in the database as they are. The app asks the browser to keep this storage rather than clear it to free space; the browser may ask you first. Nothing is synced between browsers or devices unless you turn on sync, below.
• On Linux all of this is kept in ~/.local/share/dust. Uninstalling the app leaves that folder: delete it to delete what Dust stored. A backup of your home folder copies it. Where $XDG_DATA_HOME is set, the folder is $XDG_DATA_HOME/dust instead.
• On Windows all of this is kept in %APPDATA%\dust. Uninstalling the app leaves that folder: delete it to delete what Dust stored. A backup of your user folder copies it.
• On a Mac all of this is kept in ~/Library/Application Support/dust. Deleting the app leaves that folder: delete it to delete what Dust stored. A backup of your home folder, such as Time Machine makes, copies it.

Earlier versions of Dust kept the whole history in one place: sessions.json in the folder named above, or dust_sessions in a browser. Updating Dust copies it into the way the history is kept now, and leaves that copy as it was when you updated, so that an earlier version can still open it. Deleting a session afterwards does not take it out of that copy; removing the app’s data, below, does.

Dust has no server to sync through. Sync, below, keeps your devices in step through your own Google Drive, if you turn it on; a backup file, below that, is how to move your history yourself.

Sync with your own Google Drive

Sync keeps your history, your settings and your progress towards the next level the same on each device you turn it on, through a folder of Dust's own in your Google Drive. Everything is encrypted on the device, with a passphrase only you know, before it goes: Google keeps it but cannot read it, and the developer never receives any of it.

• What goes. Everything Dust keeps that you use: your settings, every one, the volume and the paddle keys among them; every session in your history, with the same details the practice history keeps, as each device stores them; which sessions you deleted, and when; and which you put back; the level counters; the theme; and whether the guided setup and the word on the paddle keys have been shown. Every device you sync then holds the same, and works the same. What stays on each device is only its own: when it last saved a backup file, and a session it has under way.
• Where it goes. Google Drive's app data folder, in your own Google account: a folder only Dust can open, hidden among your files, and counted against your Drive's storage. Google Drive's settings show it under Manage apps, with how much it holds, and can delete it there.
• How it is encrypted. On the device, before anything is sent, with XChaCha20-Poly1305, under a key that only your passphrase opens: the passphrase is stretched into a key with Argon2id. The passphrase never leaves the device it is typed on, and is not kept, even there. The names of the files say nothing of what they hold. Google can see how many files there are, how large, and when each device reads and writes them, as with any app's data in Drive. Nobody can recover the passphrase for you, not Google and not the developer: without it, the synced copy cannot be read, though each device keeps what it holds.
• Signing in. Signing in asks Google to let Dust see its own folder only: none of your files, and nothing of any other app's. It is the drive.appdata permission. The app reaches Google directly, at accounts.google.com, oauth2.googleapis.com and www.googleapis.com, with no server of the developer's between, and with your IP address and Google account, as any app that uses Google Drive does. In a browser, the sign-in lasts about an hour and is kept in memory only. The desktop app keeps what Google gives it to sign in again, beside its other data. On Android, Google Play services keeps the sign-in. Sync, if you turn it on, reaches Google alone: its sign-in, and Google Drive. Google handles the sign-in and your Drive under Google’s privacy policy.
• What Dust does with Google's data. It reads and writes its own folder in your Drive, to sync, and nothing else. It uses nothing it is given for advertising, sells none of it, and sends none of it anywhere but back to your Drive. Dust's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
• Turning it off. On the History tab, sync can be turned off on one device, which forgets the key and the sign-in there and leaves the copy in your Drive for your other devices; or turned off with the copy deleted, which stops it on every device. What each device holds stays. To take away Dust's access to your Drive altogether, remove Dust from the third-party apps in your Google Account.

Backups. Under Stats, History, you can save a backup file of your settings and history. The web app hands it to the browser as a download; desktop builds and the Android app put it in your Downloads folder; the iPhone app puts it in its own folder in the Files app. The app never sends it anywhere. Restoring a backup reads the file you choose on the device and adds what it holds to the history there.

How that information is used

It is used only to run the trainer: to play sessions at the settings you chose, to score what you typed, to show your history and statistics, and to adjust the level when you have turned that on. It is not used to identify you, and it is not combined with anyone else’s data.

What leaves the device

Dust does not include advertising, analytics, or crash-reporting software. It asks you to sign in only to turn on sync, and then to Google alone.

The app does request its typefaces from Google Fonts (fonts.googleapis.com and fonts.gstatic.com). That request includes your IP address and the ordinary technical data a connection carries, such as the browser or web-view identifier. Your settings and practice history are not included. Google receives that request and handles it under Google’s privacy policy. On Android, iPhone and desktop it is the only request the app makes unless you turn on sync, which reaches Google as described above.

The web app is served by GitHub Pages: the page, the program and its styles are loaded from GitHub each time you open it. That sends GitHub your IP address and the same technical data, as opening any web page does, and GitHub keeps a record of the visit under the GitHub General Privacy Statement. Your settings and practice history are not part of it. Google and GitHub are the only third parties the web app contacts.

Sync is off unless you turn it on, on the History tab of Stats. Then Dust keeps a copy of your settings, your history and your level progress in a folder of its own in your Google Drive, encrypted on the device with a key made from a passphrase only you know: Google keeps the copy but cannot read it, and the developer never receives any of it.

A phone’s own backup, described above, is made by Android or iOS, not by the app, and goes to your own Google or iCloud account. On Android, what sync keeps is in the app’s storage that this backup leaves out.

If you install Dust from Google Play or the App Store, Google or Apple also handles the download and the store listing under its own policies; if you download it from GitHub, GitHub does. That collection is theirs, not a feature of the app.

Microphone, location, and other sensitive data

Dust plays sound through the speaker or headphones. It does not record the microphone. Paddle practice uses the keyboard or on-screen buttons.

Dust does not access your location, contacts, photos, or messages. It reads a file only when you choose one — a word list, or a backup to restore — and writes one only when you save a backup. It does not collect payment information. There are no purchases in the app.

Children

Dust is a general-audience practice tool. It is not directed at children, and it does not knowingly collect personal information from children.

How long it is kept, and how to delete it

The history stays on the device until you remove it: Dust never lets a session go to make room, but for a visit that keeps it in a browser’s small page storage, above. On every platform any session, or all of them, can be deleted under Stats, History, and clearing Your station removes your callsign and exchange. A deleted session leaves the note of when it finished and was deleted, above, and stays in the copy an earlier version kept, if it was there when you updated.

• Android. Uninstall Dust, or clear the app’s storage in system settings. That deletes the settings and the history from the phone. A copy Android has backed up stays in your Google account, and comes back if Dust is installed again while backup is on; turn backup off first to keep it from coming back, or delete the phone’s backup from your Google account.
• iPhone. Delete the app. That deletes the settings and the history from the iPhone. A backup of the iPhone made before then still holds them, and restoring it brings them back.
• Web. Delete all the sessions under Stats, History, and clear Your station. That leaves the practice settings, the app’s own counters and marks, none of which say who you are, the notes of the sessions deleted, any copy of a history Dust could not read and set aside, and the history an earlier version kept, as it was when you updated; and it touches no other site. Clearing the site data for https://mashu.github.io in your browser’s settings deletes everything Dust keeps there, along with what any other site at mashu.github.io keeps.
• Sync. Turn it off on the History tab, deleting the synced copy too; or delete the copy under Manage apps in Google Drive’s settings.
• Desktop. Delete the dust folder named above: ~/.local/share/dust on Linux, %APPDATA%\dust on Windows, ~/Library/Application Support/dust on macOS. Uninstalling the app does not delete it.

A backup file you saved is yours, and is deleted like any other file. There is no account to delete, because the app never receives a copy.

Sharing and sale

Dust does not sell personal information. It does not share practice history with anyone. The app sends data to no one but Google: the font request described above, and, if you turn on sync, your encrypted copy to your own Google Drive; the web app is loaded from GitHub. Dust does not share data with advertising networks or data brokers.

Changes

If this policy changes, the new version will replace this page and the effective date at the top will change. The app links here from Settings.

Contact

Questions about this policy: open an issue on GitHub.