Privacy policy

1. Data controller and contact

This policy covers www.rosrunner.com and its pages, the RosRunner application and its update service. Jason Chang, an individual publishing under the RosRunner name ("we", "us"), is responsible for personal data we process as described here. Data processed only on your computer or managed devices, and not provided to us, remains under your or your organisation’s control.

For questions or to exercise your rights, contact support@rosrunner.com. This is our current primary contact channel; it does not restrict other methods available to you by law.

2. What this website collects

We have not added forms or tracking tools to this site. The website’s source content uses no cookies, analytics, advertising trackers, session recording, device fingerprinting, or third-party fonts or scripts. We do not use website connection data for advertising, behavioural profiling or automated decisions producing legal or similarly significant effects on you, and we do not sell personal data.

Necessary connection processing. The site is hosted on Cloudflare Pages. To deliver pages, maintain security and prevent abuse, the provider processes technical data such as IP addresses, request paths and times, and user agent information sent by your browser. Retention and deletion depend on the services used, applicable settings and provider policies; not all data stays on your computer.

Hosting security features. Depending on the protection enabled and the request, Cloudflare may use necessary security cookies or verification mechanisms. The absence of cookies in our source content does not mean every connection will be cookie-free. See Cloudflare’s privacy policy and cookie documentation.

3. When you contact us

When you contact us about the product, licensing, support or security, we process the email address, name or form of address, message and attachments you provide to answer your request, troubleshoot and conduct necessary follow-up. Depending on the request, we rely on consent, a contractual or similar relationship, or another applicable basis permitted by Taiwan’s Personal Data Protection Act. Contacting us does not constitute consent to unrelated uses.

Providing information is your choice. Without a reply address or information needed to investigate an issue, we may be unable to respond or complete support. Provide only necessary data; before sharing someone else’s data, ensure you are authorised and remove unnecessary identifiers.

We retain correspondence and attachments only as needed to handle the request and the resulting licensing or support relationship. Where retention is necessary to meet a legal obligation or address a specific dispute, it is limited in scope and duration. Once the purpose ends and no other lawful basis for retention exists, we delete the data or cease processing and use; copies in provider backups may be removed separately through their backup rotation processes.

We do not use your correspondence address to send marketing emails without consent. Necessary notices relating to your request, service security or legal obligations are not marketing emails.

Do not send unnecessary confidential material. Support will not ask for a device password. Review and redact diagnostic material before sending it, following the support page. Diagnostic attachments you choose to send are handled under this section.

4. How the RosRunner application handles data

The following are product facts about the current build, verifiable from the software itself.

The application contains no telemetry. It does not send device lists, command text or output to us for product usage analytics. Management operations you request exchange the data needed to perform them with the target RouterOS devices.

Credentials. Login passwords you do not choose to save are held by the application in memory during execution; saved passwords are stored in Windows Credential Manager. Profile metadata, such as profile names and usernames, is stored separately in local JSON files without passwords. This is not an unconditional confidentiality guarantee for the operating system, memory dumps or content you export.

Local data. Device lists, Stash, preferences, credential profile metadata and diagnostic records are stored under your local user data folder, %LocalAppData%/RosRunner/, separately from the installation directory. Stash contains device entries, not command text or output. Uninstalling does not automatically delete this data folder.

Crash records and diagnostic packages. The application can save crash records locally when errors occur. The diagnostics window lists package contents, which may include application and operating system versions, error details, activity breadcrumbs and preferences. Records and packages are not uploaded automatically; you decide whether to export and send them. Review them before sending, as redaction cannot guarantee removal of every secret.

Deleting local data. When you no longer need it, close the application and remove the relevant files from that folder; this removes the corresponding settings or records. Remove saved passwords separately through the application’s credential management or Windows Credential Manager, and handle exported, copied or backed-up files separately. We cannot remotely delete this local data for you.

Outbound probing. Two external reachability checks in the device audit are disabled by default. If enabled, the device itself makes outbound connections, and the destination receives the network information needed for those connections.

Exported files. Audit reports, network maps and copied output result from your actions and may contain RouterOS configuration, device identifiers or secrets in command output. Identifier replacement on export is string substitution, not a guarantee of anonymity.

5. Update service data

The application checks for versions through update.rosrunner.com; the installed edition also downloads update packages through that service. Requests use release-feed or package file paths. The current implementation adds no statistical query parameters such as a device identifier or installed version, and does not upload device lists, passwords, commands or output through update requests.

The update service uses Cloudflare delivery and storage services. To deliver updates, prevent abuse and diagnose transfer problems, providers process source IP addresses, request times, file paths and necessary HTTP information. Package filenames can indicate the version or platform being downloaded. This necessary processing is distinct from product usage telemetry; log retention depends on service settings and provider policies.

The portable edition notifies you of updates for you to download. Opening the download page launches your default browser. Blocking connections to the update service may prevent version checks or update downloads.

6. Recipients, locations and security

We and providers of website hosting, update delivery and email services process relevant data through network transmission, electronic storage and access as needed to deliver the services described above. Processing may occur in Taiwan and other regions where providers operate or use infrastructure; a domain we own does not mean data is processed only in Taiwan.

We use or disclose data only as necessary to respond to requests, deliver these services, meet legal obligations or lawfully address specific disputes. Disclosures required by supervisory or judicial authorities are limited to what is necessary. Cross-border processing and the use of providers must comply with applicable law; provider policies do not replace our legal responsibilities.

We are responsible for appropriate safeguards proportionate to the nature and risks of the data and for limiting access to what is necessary. We will handle personal data incidents, notifications and regulatory reports as required by applicable law. No transmission or storage method can guarantee absolute security.

7. Your rights

Under Article 3 of Taiwan’s Personal Data Protection Act, you may request access to, review or a copy of personal data we hold about you, supplementation or correction, cessation of collection, processing or use, and deletion. This policy does not restrict rights that cannot lawfully be waived in advance or limited by agreement.

Write to support@rosrunner.com describing your request and information that helps identify the relevant correspondence. We may ask for evidence necessary to verify your identity, but not unrelated information. You may also complain to the competent supervisory authority.

Under Article 13 of that Act, we decide access, review or copy requests within 15 days of receipt, extendable by up to 15 days when necessary. Requests for supplementation, correction, cessation of processing or use, or deletion under the applicable provisions of Articles 3 and 11 are decided within 30 days, extendable by up to 30 days when necessary. We will notify you in writing of the reasons for an extension and explain any lawful refusal to comply in full.

If applicable law where you are provides additional rights or different deadlines, we will comply. Where processing relies on consent, you may withdraw it without affecting processing lawfully carried out before withdrawal.