SERVICE STATEMENT

Clear boundaries for a local-first marketplace.

QS Store publishes metadata and reviewed release artifacts. The widget still runs on your computer, under your user account.

Security model

Manifest permissions are declarations and review signals, not a security sandbox. QML code can have the permissions of the local user and may affect the desktop environment.

Artifact integrity

Published releases include a source commit and SHA-256 digest. Verify the digest and review the source before installing. A matching hash proves identity, not that code is harmless.

Availability

The registry and artifact service may be unavailable or change over time. Installed widgets are designed to continue working locally after installation, but QS Store does not guarantee uninterrupted service.

Data handling

The marketplace stores catalog, author, release, and review metadata. The initial service does not require telemetry or a list of your installed widgets. Do not include secrets in submissions.

Third-party content

Widgets are community software. QS Store does not endorse every author or guarantee compatibility with every Quickshell, Qt, compositor, or shell version.

Responsible use

Keep backups of local configuration, test new widgets safely, and remove or disable a widget if it behaves unexpectedly. Report security or artifact issues before sharing them publicly.

In short

Use the catalog as a source of reviewed, verifiable release information—not as a promise that third-party QML is sandboxed or risk-free.

Learn how to install with qs-store →