Security

Milldown's core promise — local files never leave your computer — is an architecture, not a setting: for everything except the two clearly-labelled, off-by-default Azure options, there is no code path that uploads a document. This page explains the moving parts.

Your documents

• Conversion, OCR and token counting run entirely on your computer. The conversion engine ships inside the app and works with Wi-Fi off. There is no server that ever sees a document.
• Features that would break this are refused, not hidden. The two optional Azure integrations — the only features that can send a document anywhere — go to your own Azure resource, are off by default, and are labelled as exactly that. Audio conversion is disabled because the engine's only transcription path uploads to an anonymous shared speech API you can't configure or hold keys for, so it can't meet even that opt-in standard.
• The engine runs as an isolated child process. Documents are hostile input by nature; parsing happens in a separate process with a hard timeout, never inside the app.
• Damaged files are detected before conversion, so a truncated download can't produce binary noise labelled "converted".

No tracking

• The app contains no analytics, no telemetry, no crash reporting, and no account system. It does not phone home to say you launched it or what you converted.
• This website sets no cookies and uses cookieless, aggregate-only analytics. Details in the privacy policy.

Code signing and notarization

• Signed with a Developer ID and notarized by Apple. Every release build is signed inside-out with our Apple Developer ID certificate and submitted to Apple, which scans it for malware and issues a notarization ticket. That ticket is stapled into the app, so macOS Gatekeeper verifies it — even offline — and opens it on the first launch with no security warning. You can check any copy yourself with spctl -a -vv Milldown.app, which reports source=Notarized Developer ID.
• Updates are signed twice: the notarized build above, and update archives that additionally carry an EdDSA signature the updater verifies before installing anything.

Licences

• Licences are cryptographically signed (Ed25519). The app verifies every licence-server response against a key embedded in the app itself — a spoofed server cannot fake a licence, and a licence you bought keeps verifying even if our servers were gone.
• Licence checks carry no document data — only your key and your computer's name, for seat counting.

Payments

Purchases run through Stripe as merchant of record. Card details never touch us or our servers — we receive your email address and order details, nothing more.

Reporting a vulnerability

Write to security@milldown.app. We read every report, respond quickly, and credit researchers who wish to be named. Please include steps to reproduce.