Security

Milldown's core promise — your documents never leave your Mac — is an architecture, not a setting. This page explains the moving parts, plainly.

Your documents

• Conversion, OCR and token counting run entirely on your Mac. The conversion engine ships inside the app and works with Wi-Fi off. There is no server that ever sees a document.
• Features that would break this are refused, not hidden. Audio conversion is disabled because the engine's only transcription path uploads to a cloud speech service. The two optional Azure integrations — the only features that can send a document anywhere — are off by default and labelled as exactly that.
• The engine runs as an isolated child process. Documents are hostile input by nature; parsing happens in a separate process with a hard timeout, never inside the app.
• Damaged files are detected before conversion, so a truncated download can't produce binary noise labelled "converted".

No tracking

• The app contains no analytics, no telemetry, no crash reporting, and no account system. It does not phone home to say you launched it or what you converted.
• This website sets no cookies and uses cookieless, aggregate-only analytics. Details in the privacy policy.

Licences and updates

• Licences are cryptographically signed (Ed25519). The app verifies every licence-server response against a key embedded in the app itself — a spoofed server cannot fake a licence, and a licence you bought keeps verifying even if our servers were gone.
• Licence checks carry no document data — only your key and your Mac's name, for seat counting.
• Updates are signed twice: every release is notarized by Apple, and update archives carry an EdDSA signature the updater verifies before installing anything.

Payments

Purchases run through Stripe as merchant of record. Card details never touch us or our servers — we receive your email address and order details, nothing more.

Reporting a vulnerability

Write to security@milldown.app. We read every report, respond quickly, and credit researchers who wish to be named. Please include steps to reproduce.