commit cac68780eed755fcbf3081068b192ac9afaf988d
Author: samialabri <sami.alabri@gmail.com>
Date:   Fri Oct 30 18:51:19 2026 +0400

    Kestrove website: home page with downloads, support and privacy pages
    
    Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..e43b0f9
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1 @@
+.DS_Store
diff --git a/README.md b/README.md
new file mode 100644
index 0000000..391c1d3
--- /dev/null
+++ b/README.md
@@ -0,0 +1,12 @@
+# Kestrove website
+
+The public website: the home page with downloads, and the support and privacy pages the store listings link to.
+It's plain static files with nothing to build, and it loads nothing from other sites.
+
+- Keep `/support.html` and `/privacy.html` at these addresses: the App Store, Google Play, Chrome and Firefox listings point to them.
+- To release a platform, edit its card in `index.html`: set the store link, then remove the `soon` class and the badge. The main button picks it up.
+- For a new Windows version, change the version in the Windows card's link.
+
+To host it, serve this folder with any web server. `deploy/Caddyfile.snippet` is a Caddy example with the security headers.
+
+To preview it locally, run `python3 -m http.server 8090` here.
diff --git a/assets/fonts/Inter-Latin.woff2 b/assets/fonts/Inter-Latin.woff2
new file mode 100644
index 0000000..d15208d
Binary files /dev/null and b/assets/fonts/Inter-Latin.woff2 differ
diff --git a/assets/fonts/JetBrainsMono-Latin.woff2 b/assets/fonts/JetBrainsMono-Latin.woff2
new file mode 100644
index 0000000..cd5102a
Binary files /dev/null and b/assets/fonts/JetBrainsMono-Latin.woff2 differ
diff --git a/assets/iphone.png b/assets/iphone.png
new file mode 100644
index 0000000..5acac4b
Binary files /dev/null and b/assets/iphone.png differ
diff --git a/assets/mac.png b/assets/mac.png
new file mode 100644
index 0000000..f17ec2e
Binary files /dev/null and b/assets/mac.png differ
diff --git a/assets/mark.svg b/assets/mark.svg
new file mode 100644
index 0000000..02510fc
--- /dev/null
+++ b/assets/mark.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 48 48"><rect width="48" height="48" rx="12" fill="#19604f"/><path fill="#fff" d="M14 34 C 18 22, 26 14, 38 11 C 33 16, 29 21, 27 27 L 34 37 L 27 37 L 22 30 Z"/><circle cx="18.5" cy="17.5" r="3.5" fill="#e0703f"/><rect x="16.5" y="21" width="4" height="13" rx="2" fill="#fff"/></svg>
diff --git a/deploy/Caddyfile.snippet b/deploy/Caddyfile.snippet
new file mode 100644
index 0000000..88f6554
--- /dev/null
+++ b/deploy/Caddyfile.snippet
@@ -0,0 +1,16 @@
+# The Kestrove website: static files only. Replace DOMAIN and the root path.
+DOMAIN {
+	encode zstd gzip
+	root * /srv/kestrove-website
+	header {
+		Strict-Transport-Security "max-age=63072000"
+		X-Content-Type-Options nosniff
+		Referrer-Policy strict-origin-when-cross-origin
+		Content-Security-Policy "default-src 'self'; img-src 'self'; style-src 'self'; script-src 'self'; font-src 'self'; frame-ancestors 'none'; base-uri 'none'; form-action 'none'"
+		X-Frame-Options DENY
+		-Server
+	}
+	@assets path /assets/*
+	header @assets Cache-Control "public, max-age=604800"
+	file_server
+}
diff --git a/favicon.svg b/favicon.svg
new file mode 100644
index 0000000..4a6a8d4
--- /dev/null
+++ b/favicon.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 48 48"><rect width="48" height="48" rx="12" fill="#19604f"/><path fill="#fff" d="M14 34 C 18 22, 26 14, 38 11 C 33 16, 29 21, 27 27 L 34 37 L 27 37 L 22 30 Z"/><circle cx="18.5" cy="17.5" r="3.5" fill="#b4481f"/><rect x="16.5" y="21" width="4" height="13" rx="2" fill="#fff"/></svg>
diff --git a/index.html b/index.html
new file mode 100644
index 0000000..67e0737
--- /dev/null
+++ b/index.html
@@ -0,0 +1,122 @@
+<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>Kestrove: the password manager you host yourself</title>
+<meta name="description" content="Kestrove keeps your passwords and passkeys encrypted on your own devices and syncs them through a server you run. For iPhone, Mac, Android, Windows and Linux.">
+<meta name="theme-color" content="#19604f">
+<meta property="og:title" content="Kestrove: the password manager you host yourself">
+<meta property="og:description" content="Your passwords, encrypted on your devices and synced through your own server.">
+<meta property="og:image" content="https://kestrove.samialabri.com/assets/mac.png">
+<link rel="canonical" href="https://kestrove.samialabri.com/">
+<link rel="icon" href="/favicon.svg" type="image/svg+xml">
+<link rel="preload" href="/assets/fonts/Inter-Latin.woff2" as="font" type="font/woff2" crossorigin>
+<link rel="stylesheet" href="/site.css">
+<script src="/site.js" defer></script>
+</head>
+<body>
+<a class="skip" href="#main">Skip to content</a>
+<header class="nav">
+  <div class="wrap nav-in">
+    <a class="lockup" href="/" aria-label="Kestrove home"><img src="/assets/mark.svg" alt="" width="32" height="32"><span>kestrove</span></a>
+    <nav aria-label="Main">
+      <a href="#features">Features</a>
+      <a href="#host">Hosting</a>
+      <a href="/support.html">Support</a>
+      <a class="nav-get" href="#download">Download</a>
+    </nav>
+  </div>
+</header>
+
+<main id="main">
+<section class="hero">
+  <div class="wrap hero-in">
+    <div class="hero-copy">
+      <h1>The password manager you host yourself.</h1>
+      <p class="lead">Your passwords and passkeys are encrypted on your own devices, then synced through a server you run. That server only ever stores data it can't read.</p>
+      <div class="cta">
+        <a class="btn primary" id="hero-cta" href="#download">See all downloads</a>
+        <a class="btn" id="hero-more" href="#host" >Run your own server</a>
+      </div>
+      <p class="note" id="hero-note">For iPhone, iPad, Mac, Android, Windows and Linux.</p>
+    </div>
+    <div class="shots">
+      <img class="shot-mac" src="/assets/mac.png" width="1500" height="805" alt="Kestrove on a Mac: a list of logins beside a saved login with its username, hidden password and one-time code.">
+      <img class="shot-phone" src="/assets/iphone.png" width="598" height="1300" alt="Kestrove on an iPhone: the vault with logins, a bank, a passport and a card.">
+    </div>
+  </div>
+</section>
+
+<section class="pillars">
+  <div class="wrap grid three">
+    <div><h2>Encrypted before it leaves</h2><p>Your master password and a Secret Key protect your vault on the device itself. Only encrypted data ever reaches your server.</p></div>
+    <div><h2>On a server you choose</h2><p>Run it for yourself, your family or your company, on your own domain. Or skip the server and keep your vault on one device.</p></div>
+    <div><h2>No tracking</h2><p>No ads, no analytics and no account with us. <a href="/privacy.html">Read the privacy policy</a>.</p></div>
+  </div>
+</section>
+
+<section class="band" id="features">
+  <div class="wrap">
+    <h2 class="title">Everything you expect, on everything you use</h2>
+    <ul class="grid three features">
+      <li><h3>Autofill everywhere</h3><p>Fill logins in apps and browsers, and save new ones as you create them.</p></li>
+      <li><h3>Passkeys</h3><p>Store passkeys and use them to sign in without a password.</p></li>
+      <li><h3>One-time codes</h3><p>Keep two-factor codes next to the login they belong to, ready to fill.</p></li>
+      <li><h3>More than passwords</h3><p>Secure notes, cards and identities, organised with tags and favourites.</p></li>
+      <li><h3>Easy to move in</h3><p>Import from 1Password or a CSV file. Generate strong passwords as you go.</p></li>
+      <li><h3>Add devices with a QR code</h3><p>Scan a code from your vault to set up a new phone or computer.</p></li>
+    </ul>
+  </div>
+</section>
+
+<section id="host">
+  <div class="wrap split">
+    <div>
+      <h2 class="title">Your server, in about five minutes</h2>
+      <p>Kestrove's server runs anywhere Docker does. It comes with a web vault and an admin page for inviting people. The admin can manage accounts but can't read anyone's passwords.</p>
+      <p><a class="btn" href="https://gitea.samialabri.com/kestrove/kestrove-server/src/branch/main/selfhost/README.md">Read the hosting guide</a></p>
+    </div>
+    <ol class="steps">
+      <li><strong>Start your server</strong><span>Point a domain at it and run the setup.</span></li>
+      <li><strong>Create your account</strong><span>Save your Emergency Kit somewhere safe.</span></li>
+      <li><strong>Add your devices</strong><span>Scan the QR code with each Kestrove app.</span></li>
+    </ol>
+  </div>
+</section>
+
+<section class="band" id="download">
+  <div class="wrap">
+    <h2 class="title">Get Kestrove</h2>
+    <p class="sub">Install it on every device you use.</p>
+    <!-- To release a platform: put the store link in href, and remove the "soon" class and the badge. -->
+    <div class="grid three cards">
+      <article class="card soon" data-os="ios"><h3>iPhone and iPad</h3><p>App Store</p><span class="badge">Coming soon</span>
+        <a class="btn" href="https://apps.apple.com/app/kestrove/idREPLACE_ME" data-label="Download on the App Store">Get it on the App Store</a></article>
+      <article class="card soon" data-os="mac"><h3>Mac</h3><p>Mac App Store</p><span class="badge">Coming soon</span>
+        <a class="btn" href="https://apps.apple.com/app/kestrove/idREPLACE_ME" data-label="Download for Mac">Get it on the Mac App Store</a></article>
+      <article class="card soon" data-os="android"><h3>Android</h3><p>Google Play</p><span class="badge">Coming soon</span>
+        <a class="btn" href="https://play.google.com/store/apps/details?id=com.samialabri.kestrove" data-label="Get it on Google Play">Get it on Google Play</a></article>
+      <article class="card" data-os="windows"><h3>Windows</h3><p>Windows 10 and 11, 64-bit. Updates itself.</p>
+        <a class="btn" href="https://gitea.samialabri.com/kestrove/kestrove-desktop/releases/download/v1.2.0/Kestrove_1.2.0_x64-setup.exe" data-label="Download for Windows">Download installer</a></article>
+      <article class="card soon" id="linux" data-os="linux"><h3>Linux</h3><p>Snap Store</p><span class="badge">Coming soon</span>
+        <pre class="cmd"><code>sudo snap install kestrove</code></pre>
+        <p class="fine">Open a terminal, run this command, then start Kestrove from your applications.</p></article>
+      <article class="card" data-os="browser"><h3>Browser extension</h3><p>Fills from the Kestrove app on your computer.</p>
+        <div class="row">
+          <a class="btn" href="https://chromewebstore.google.com/detail/pmhfoafjoogobhfadaicklhkldgnafmk">Chrome</a>
+          <a class="btn" href="https://addons.mozilla.org/en-US/firefox/addon/kestrove/">Firefox</a>
+        </div></article>
+    </div>
+  </div>
+</section>
+</main>
+
+<footer>
+  <div class="wrap foot">
+    <a class="lockup" href="/"><img src="/assets/mark.svg" alt="" width="24" height="24"><span>kestrove</span></a>
+    <nav aria-label="Footer"><a href="/support.html">Support</a><a href="/privacy.html">Privacy</a></nav>
+  </div>
+</footer>
+</body>
+</html>
diff --git a/legal.css b/legal.css
new file mode 100644
index 0000000..4ad9db1
--- /dev/null
+++ b/legal.css
@@ -0,0 +1,18 @@
+/* Privacy policy and support pages (static; the web vault's CSP allows only same-origin styles). */
+:root { --bg: #f7f8f7; --surface: #ffffff; --text: #16211d; --text2: #4a5a54; --primary: #19604f; --border: #dde3e0; }
+@media (prefers-color-scheme: dark) {
+  :root { --bg: #0f1513; --surface: #161e1b; --text: #e8eeeb; --text2: #a7b5af; --primary: #5cc1a5; --border: #2a3531; }
+}
+* { box-sizing: border-box; }
+body { margin: 0; background: var(--bg); color: var(--text); font: 16px/1.6 -apple-system, BlinkMacSystemFont, "Segoe UI", Inter, Roboto, sans-serif; }
+main { max-width: 720px; margin: 0 auto; padding: 40px 16px 64px; }
+header { display: flex; align-items: center; gap: 12px; margin-bottom: 24px; }
+header img { width: 40px; height: 40px; }
+h1 { font-size: 28px; line-height: 1.2; margin: 0; letter-spacing: -0.02em; }
+h2 { font-size: 19px; margin: 32px 0 8px; }
+p, li { color: var(--text); }
+.muted { color: var(--text2); font-size: 14px; }
+a { color: var(--primary); }
+section { background: var(--surface); border: 1px solid var(--border); border-radius: 16px; padding: 4px 20px 16px; margin-top: 16px; }
+code { font-family: ui-monospace, "JetBrains Mono", monospace; font-size: 0.92em; }
+.home { margin: 0 0 16px; font-size: 15px; }
diff --git a/privacy.html b/privacy.html
new file mode 100644
index 0000000..e8fd470
--- /dev/null
+++ b/privacy.html
@@ -0,0 +1,64 @@
+<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>Kestrove Privacy Policy</title>
+<link rel="icon" href="/favicon.svg" type="image/svg+xml">
+<link rel="stylesheet" href="/legal.css">
+</head>
+<body>
+<main>
+<p class="home"><a href="/">Kestrove home</a></p>
+<header><img src="/favicon.svg" alt=""><h1>Privacy Policy</h1></header>
+<p class="muted">Kestrove apps for iPhone, iPad, Mac, Android, Windows and Linux, the Kestrove browser extension, and the Kestrove server. Effective 30 October 2026.</p>
+
+<section>
+<h2>The short version</h2>
+<p>Kestrove does not collect any data about you. There are no accounts with us, no analytics, no advertising and no tracking. Your passwords are encrypted on your own devices and are only ever synced to a server <strong>you</strong> choose and run.</p>
+</section>
+
+<section>
+<h2>Your vault</h2>
+<p>Everything you store in Kestrove (logins, passwords, passkeys, notes, cards and other items) is encrypted on your device with keys derived from your master password and your Secret Key before it is saved or synced. Neither the developer of Kestrove nor the operator of the server can read it.</p>
+<p>When you turn on sync, your encrypted vault is sent to the Kestrove server at the address you enter in the app. That server is run by you (or by someone you choose); it is not operated by the developer. It stores encrypted vault data, your devices' public keys and names, and a login verifier that is not your password (OPAQUE). Its operator is responsible for it.</p>
+</section>
+
+<section>
+<h2>What the apps use on your device</h2>
+<ul>
+<li><strong>Face ID, Touch ID or fingerprint</strong>: to unlock your vault. Biometric data never leaves your device's secure hardware, and Kestrove never receives it.</li>
+<li><strong>Camera</strong>: only to scan Kestrove setup and sign-in QR codes. Nothing is recorded or stored.</li>
+<li><strong>AutoFill, Credential Manager and the browser extension</strong>: to offer and fill your saved logins and passkeys in apps and websites. The website or app address is used on your device to find matching items and is not sent anywhere.</li>
+<li><strong>Network</strong>: only to talk to your own Kestrove server. The one exception is the Windows app, which checks for updates once a day. That check reveals your computer's IP address and the app version to the server that hosts the updates, and nothing from your vault. You can turn it off in Settings.</li>
+</ul>
+</section>
+
+<section>
+<h2>This website</h2>
+<p>This website has no analytics, cookies or trackers. Like any web server, it may keep short-lived technical logs, including IP addresses, to keep the site running.</p>
+</section>
+
+<section>
+<h2>Sharing and selling</h2>
+<p>No data is shared with or sold to anyone, because no data is collected.</p>
+</section>
+
+<section>
+<h2>Deleting your data</h2>
+<p>Deleting the app removes the data on that device. Your server's operator can remove a device from your account in the web vault (Devices) or delete the server's data entirely.</p>
+</section>
+
+<section>
+<h2>Children</h2>
+<p>Kestrove is not directed at children and collects no personal information from anyone.</p>
+</section>
+
+<section>
+<h2>Changes and contact</h2>
+<p>If this policy changes, the new version is published at this address with a new effective date.</p>
+<p>Questions: <a href="/support.html">Kestrove support</a>.</p>
+</section>
+</main>
+</body>
+</html>
diff --git a/robots.txt b/robots.txt
new file mode 100644
index 0000000..92cdd33
--- /dev/null
+++ b/robots.txt
@@ -0,0 +1,3 @@
+User-agent: *
+Allow: /
+Sitemap: https://kestrove.samialabri.com/sitemap.xml
diff --git a/site.css b/site.css
new file mode 100644
index 0000000..5871c5e
--- /dev/null
+++ b/site.css
@@ -0,0 +1,108 @@
+/* Kestrove website. Colours and type follow kestrove-spec/design/tokens.json. */
+@font-face { font-family: Inter; src: url(/assets/fonts/Inter-Latin.woff2) format("woff2"); font-weight: 100 900; font-display: swap; }
+@font-face { font-family: "JetBrains Mono"; src: url(/assets/fonts/JetBrainsMono-Latin.woff2) format("woff2"); font-weight: 100 800; font-display: swap; }
+:root {
+  --bg: #f4f6f4; --surface: #fff; --surface-2: #eef2ef; --border: #d5ddd8; --text: #13201b; --text-2: #4a5852;
+  --primary: #19604f; --primary-hover: #134d3f; --primary-soft: #dcefe8; --on-primary: #fff; --focus: #2f7dd1;
+  color-scheme: light dark;
+}
+@media (prefers-color-scheme: dark) {
+  :root {
+    --bg: #0b1210; --surface: #121b18; --surface-2: #18231f; --border: #26352f; --text: #e4ebe7; --text-2: #a9b7b0;
+    --primary: #5ec6a3; --primary-hover: #7fd5b8; --primary-soft: #173a30; --on-primary: #05201a; --focus: #7cb8ff;
+  }
+}
+* { box-sizing: border-box; }
+html { scroll-behavior: smooth; scroll-padding-top: 80px; -webkit-text-size-adjust: 100%; }
+body { margin: 0; background: var(--bg); color: var(--text); font: 17px/1.6 Inter, -apple-system, "Segoe UI", Roboto, sans-serif; font-feature-settings: "cv11", "ss01"; }
+img { max-width: 100%; height: auto; display: block; }
+a { color: var(--primary); }
+a:hover { color: var(--primary-hover); }
+:focus-visible { outline: 2px solid var(--focus); outline-offset: 2px; border-radius: 4px; }
+h1, h2, h3 { line-height: 1.2; letter-spacing: -0.02em; margin: 0; text-wrap: balance; }
+h3 { font-size: 18px; }
+p { margin: 0; }
+ul, ol { list-style: none; margin: 0; padding: 0; }
+.wrap { max-width: 1120px; margin: 0 auto; padding: 0 16px; }
+.skip { position: absolute; left: -999px; top: 8px; background: var(--surface); padding: 8px 12px; z-index: 3; }
+.skip:focus { left: 8px; }
+section { padding: 72px 0; }
+.band { background: var(--surface); border-block: 1px solid var(--border); }
+.title { font-size: clamp(26px, 4vw, 34px); }
+.sub { color: var(--text-2); margin-top: 8px; }
+.grid { display: grid; gap: 16px; }
+.three { grid-template-columns: repeat(3, minmax(0, 1fr)); }
+
+.nav { position: sticky; top: 0; z-index: 2; background: color-mix(in srgb, var(--bg) 85%, transparent); backdrop-filter: blur(14px); -webkit-backdrop-filter: blur(14px); border-bottom: 1px solid var(--border); }
+.nav-in { display: flex; align-items: center; justify-content: space-between; height: 64px; gap: 16px; }
+.nav nav { display: flex; align-items: center; gap: 24px; font-size: 15px; font-weight: 500; }
+.nav nav a { color: var(--text-2); text-decoration: none; }
+.nav nav a:hover { color: var(--text); }
+.nav nav a.nav-get { color: var(--primary); font-weight: 600; }
+.lockup { display: inline-flex; align-items: center; gap: 10px; color: var(--text); text-decoration: none; font-weight: 700; font-size: 20px; letter-spacing: -0.02em; }
+
+.hero { padding: 72px 0 80px; overflow: hidden; }
+.hero-in { display: grid; grid-template-columns: minmax(0, 5fr) minmax(0, 6fr); gap: 48px; align-items: center; }
+.hero h1 { font-size: clamp(38px, 6vw, 58px); letter-spacing: -0.03em; }
+.lead { font-size: 19px; color: var(--text-2); margin-top: 20px; max-width: 34em; }
+.cta { display: flex; flex-wrap: wrap; gap: 12px; margin-top: 28px; }
+.note { color: var(--text-2); font-size: 15px; margin-top: 14px; }
+.btn { display: inline-flex; align-items: center; justify-content: center; min-height: 48px; padding: 10px 20px; border-radius: 10px; border: 1px solid var(--border); background: var(--surface); color: var(--text); font-weight: 600; font-size: 16px; text-decoration: none; transition: background .15s cubic-bezier(.2,.7,.2,1); }
+.btn:hover { background: var(--surface-2); color: var(--text); }
+.btn.primary { background: var(--primary); border-color: var(--primary); color: var(--on-primary); }
+.btn.primary:hover { background: var(--primary-hover); border-color: var(--primary-hover); color: var(--on-primary); }
+.shots { position: relative; padding-bottom: 32px; }
+.shot-mac { width: 100%; border-radius: 12px; border: 1px solid var(--border); box-shadow: 0 16px 48px rgb(0 0 0 / .14); }
+.shot-phone { position: absolute; right: -8px; bottom: 0; width: 25%; border-radius: 18px; border: 1px solid var(--border); box-shadow: 0 12px 32px rgb(0 0 0 / .2); }
+
+.pillars { padding: 0 0 72px; }
+.pillars h2 { font-size: 20px; margin-bottom: 8px; }
+.pillars p { color: var(--text-2); }
+.features { margin-top: 32px; column-gap: 40px; row-gap: 32px; }
+.features h3 { margin-bottom: 6px; }
+.features p { color: var(--text-2); }
+
+.split { display: grid; grid-template-columns: minmax(0, 1fr) minmax(0, 1fr); gap: 56px; align-items: center; }
+.split p { color: var(--text-2); margin-top: 16px; }
+.split p .btn { margin-top: 8px; }
+.steps { counter-reset: step; display: grid; gap: 12px; }
+.steps li { counter-increment: step; position: relative; background: var(--surface); border: 1px solid var(--border); border-radius: 14px; padding: 16px 18px 16px 66px; }
+.steps li::before { content: counter(step); position: absolute; left: 18px; top: 18px; width: 32px; height: 32px; border-radius: 50%; background: var(--primary-soft); color: var(--primary); font-weight: 700; display: grid; place-items: center; }
+.steps strong, .steps span { display: block; }
+.steps span { color: var(--text-2); font-size: 15px; }
+
+.cards { margin-top: 32px; }
+.card { position: relative; display: flex; flex-direction: column; gap: 8px; background: var(--bg); border: 1px solid var(--border); border-radius: 16px; padding: 20px; min-width: 0; }
+.card > p { color: var(--text-2); font-size: 15px; }
+.card > .btn, .card .row { margin-top: auto; }
+.card > h3 + p { margin-bottom: 8px; }
+.card .row { display: flex; gap: 8px; }
+.card .row .btn { flex: 1; }
+.card.yours { border-color: var(--primary); box-shadow: 0 0 0 1px var(--primary); }
+.card.soon > .btn { display: none; }
+.badge { align-self: flex-start; margin-top: auto; padding: 3px 10px; border-radius: 999px; background: var(--surface-2); color: var(--text-2); font-size: 13px; font-weight: 600; }
+.cmd { margin: 4px 0 0; padding: 10px 12px; background: var(--surface-2); border-radius: 8px; overflow-x: auto; font: 14px "JetBrains Mono", ui-monospace, monospace; }
+.card.soon .cmd, .card.soon .fine { order: 1; }
+.fine { font-size: 14px; color: var(--text-2); }
+
+footer { padding: 32px 0; }
+.foot { display: flex; align-items: center; justify-content: space-between; gap: 16px; }
+.foot .lockup { font-size: 17px; }
+.foot nav { display: flex; gap: 20px; font-size: 15px; }
+
+@media (max-width: 860px) {
+  section { padding: 56px 0; }
+  .hero { padding: 40px 0 56px; }
+  .hero-in, .split { grid-template-columns: minmax(0, 1fr); gap: 36px; }
+  .three { grid-template-columns: repeat(2, minmax(0, 1fr)); }
+  .shot-phone { right: 0; }
+}
+@media (max-width: 560px) {
+  .three { grid-template-columns: minmax(0, 1fr); }
+  .nav nav a:not(.nav-get) { display: none; }
+  .cta .btn { flex: 1 1 100%; }
+}
+@media (prefers-reduced-motion: reduce) {
+  html { scroll-behavior: auto; }
+  .btn { transition: none; }
+}
diff --git a/site.js b/site.js
new file mode 100644
index 0000000..d312503
--- /dev/null
+++ b/site.js
@@ -0,0 +1,28 @@
+// Points the main button at this visitor's platform. The download cards in index.html are the only list of
+// links: release a platform there and this picks it up. Without JavaScript the page still works.
+const NAMES = { ios: "iPhone", mac: "Mac", android: "Android", windows: "Windows", linux: "Linux" };
+
+function detect() {
+  const ua = navigator.userAgent;
+  if (/iPhone|iPad|iPod/.test(ua) || (/Macintosh/.test(ua) && navigator.maxTouchPoints > 1)) return "ios";
+  if (/Android/.test(ua)) return "android";
+  if (/Macintosh/.test(ua)) return "mac";
+  if (/Windows/.test(ua)) return "windows";
+  if (/Linux|X11/.test(ua)) return "linux";
+  return null;
+}
+
+const os = detect();
+const card = os && document.querySelector(`.card[data-os="${os}"]`);
+if (card) {
+  card.classList.add("yours");
+  const cta = document.getElementById("hero-cta");
+  const note = document.getElementById("hero-note");
+  const link = card.querySelector("a.btn");
+  if (card.classList.contains("soon")) {
+    note.textContent = `Kestrove for ${NAMES[os]} is coming soon.`;
+  } else if (link) {
+    cta.href = link.href;
+    cta.textContent = link.dataset.label;
+  }
+}
diff --git a/sitemap.xml b/sitemap.xml
new file mode 100644
index 0000000..6fc95bb
--- /dev/null
+++ b/sitemap.xml
@@ -0,0 +1,6 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
+<url><loc>https://kestrove.samialabri.com/</loc></url>
+<url><loc>https://kestrove.samialabri.com/support.html</loc></url>
+<url><loc>https://kestrove.samialabri.com/privacy.html</loc></url>
+</urlset>
diff --git a/support.html b/support.html
new file mode 100644
index 0000000..1031338
--- /dev/null
+++ b/support.html
@@ -0,0 +1,40 @@
+<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>Kestrove Support</title>
+<link rel="icon" href="/favicon.svg" type="image/svg+xml">
+<link rel="stylesheet" href="/legal.css">
+</head>
+<body>
+<main>
+<p class="home"><a href="/">Kestrove home</a></p>
+<header><img src="/favicon.svg" alt=""><h1>Kestrove Support</h1></header>
+<p>Kestrove is a password manager you host yourself: your vault is end-to-end encrypted and syncs only through your own Kestrove server.</p>
+
+<section>
+<h2>Getting started</h2>
+<ol>
+<li>Set up a Kestrove server: <a href="https://gitea.samialabri.com/kestrove/kestrove-server/src/branch/main/selfhost/README.md">self-hosting guide</a> (about five minutes with Docker).</li>
+<li>Open your server's web address, create your account with the setup code, and save your Emergency Kit.</li>
+<li>In the web vault choose <strong>Devices → Add a device</strong>, then scan the QR code with the Kestrove app on your phone or computer.</li>
+</ol>
+</section>
+
+<section>
+<h2>Common questions</h2>
+<p><strong>I forgot my master password.</strong> Nobody can recover it, including the developer and your server: that is what end-to-end encryption means. If another device is still unlocked, export your data from it.</p>
+<p><strong>The app says it can't reach the server.</strong> Open your server's address in a browser on the same device. If the server moved to a new IP address, update your DNS record.</p>
+<p><strong>The browser extension says the app isn't available.</strong> On a Mac, open the Kestrove app; on Windows and Linux, the Kestrove desktop app. Then click Connect in the extension and confirm the six words match.</p>
+<p><strong>Autofill doesn't offer Kestrove.</strong> iPhone/iPad: Settings → General → AutoFill &amp; Passwords → turn on Kestrove. Android: Settings → Passwords &amp; accounts → Preferred service → Kestrove.</p>
+</section>
+
+<section>
+<h2>Report a problem</h2>
+<p>Open an issue on <a href="https://gitea.samialabri.com/kestrove/kestrove-spec/issues">the Kestrove issue tracker</a>. Never include passwords, your Secret Key or your Emergency Kit.</p>
+<p class="muted"><a href="/privacy.html">Privacy Policy</a></p>
+</section>
+</main>
+</body>
+</html>