Fail closed where dictation can hurt.

Trust boundaries

• Local mode keeps audio, transcripts, dictionary processing and cleanup on the Mac.
• Paid bring-your-own-key cloud routes use API keys stored in macOS Keychain and send only the data required by the selected transcription or cleanup provider.
• The app does not take screenshots and does not read window titles or the contents of other fields and windows. With learning from corrections on (the default), it reads the one editable field it just inserted into, locally and in memory, for up to two minutes, and keeps only short correction pairs. Secure fields are never watched. App identifiers and supported browser hosts can be inspected locally for formatting.
• Secure fields are refused. The original app and window must still match at commit time. Within that window, text goes to the current cursor, so you can press the shortcut and then click into the intended field.
• Some browser and Electron controls do not expose enough Accessibility information to verify an individual field. In the same app and window, Rambleproof treats that focus as the current cursor; a different app or window falls back to a recovery notice.
• With Keep a copy after insertion off, temporary paste text is marked concealed and auto-generated for clipboard managers that honor those conventions, then the original clipboard is restored. Explicit copies, no-field fallback copies and copies kept after insertion remain on the clipboard.

Safe fallback behavior

• Slow or failed cloud transcription can race a local fallback instead of stranding the dictation.
• Cleanup that changes protected facts or fails validation is rejected in favor of transcript-level deterministic cleanup.
• A different app or window, a secure field, or a control known not to accept text receives no synthetic paste. Known non-text destinations always copy the result for manual pasting. Secure fields and app/window changes honor the clipboard preference and retain a recovery preview if copying is off.
• Completed, copied and cancelled sessions lose journal audio immediately. Optional failed audio expires after 24 hours. The separate Recordings folder, on by default, keeps a copy of the audio and text of each dictation until you delete it or turn it off. From version 1.2.2 it is in ~/Library/Application Support/Rambleproof/Recordings, which iCloud Drive and similar sync services do not sync. Recordings from earlier versions stay in Documents, as the privacy page explains.

License controls

• Free entitlement is decided on the Mac and needs no license request. Linked Macs report weekly counts only, as described on the privacy page.
• Pro subscriptions send only the license key to moelueker.com every 14 days. A failed check uses a 30-day offline grace period before paid capabilities return to Free.
• Lifetime and gift keys carry Ed25519 signatures and are verified offline before any network path is considered.
• Private license-signing keys never enter the app, repository, or Vercel. The app contains only the public verification key.
• A missing, expired, cancelled or invalid license can reduce capabilities only to Free. It never disables raw local dictation or a safety feature.

Accounts and offline access

Website sessions are verified by Supabase Auth. Database row policies restrict customer reads to their own account, devices and purchases; billing writes and owner tools stay on the server. Browser sign-in and download requests use Cloudflare Turnstile alongside rate limits.

In account-enabled app versions, the initial browser link produces a signed receipt bound to that installation. The Mac verifies it locally. Background version reports use a separate credential stored in Keychain. An expired reporting credential or an account-service outage cannot revoke the local activation. Existing installations retain their access. The receipt activates local use; paid features still follow license or team access checks.

Team roles and billing permissions are checked on the server for each action. Invitations require the matching verified email. Team Pro uses a separate signed receipt bound to the account and Mac, lasting up to 30 days offline. Revoking access applies after an online refresh; a disconnected Mac may retain its earlier grant until it expires. Personal paid licenses and Free local dictation remain independent.

Dictionary sync is off until you turn it on, on each device separately. While it is on, the copy of your dictionary kept with your account is encrypted with a key that the website holds and the database does not, and a copy can be read only for the account it belongs to. The website decrypts it to hand it to your devices, so this is not end-to-end encryption. The server stores the copy and hands it back; your devices do the merging. Disconnecting a Mac turns its sync off.

For IT and security reviews

What a Mac running Rambleproof in local mode, the default, sends, and to whom. The privacy page has the full wording.

• Never sent: audio, dictated text, the names of the apps dictated into, or anything read from a text field.
• Only when the person turns dictionary sync on: a copy of their own dictionary, stored encrypted with their account so their other devices can fetch it. It is off on every Mac until they switch it on there, and team managers cannot read it.
• Team dictionary, from version 1.2.8: every linked Mac asks the site a few times a day which team word lists it may have. It sends only its credential and the revision numbers of the lists it holds. It receives a list only for a team where the person holds a seat: the words and replacements that team's owners and admins entered on the website, stored encrypted with the team. Nothing from the person's own dictionary is sent, and team managers cannot read that one.
• Linking a Mac to an account: the account, the kind of Mac and its macOS version, to our database at Supabase in the United States.
• About once a day while online: the app version, the plan, and for this week and last week the number of dictations and words. Counts only.
• Update check, once a day: the app version and macOS version. It can be turned off under Advanced.
• Model downloads: the speech and cleanup models are fetched once from the host that serves the files. The request carries no account data.
• Only when the person presses Send: a feedback or problem report, with what the form shows before sending.
• Only when the person adds their own API key: audio or text to the provider they chose (OpenAI, OpenRouter or Google Gemini). This is off until they turn it on.

Services that handle account data: Supabase (sign-in and the account database), Stripe (payments and invoices; we store no card numbers), Resend (account email), Vercel (website hosting), Cloudflare Turnstile (sign-in abuse protection) and Upstash (rate limits and a short recovery buffer). PostHog and Google Analytics measure visits to this website only, never the app.

The app needs Microphone and Accessibility, and Input Monitoring only when a single key is chosen as the dictation key. Sign-in is a verified email or Google. Company SSO, automated provisioning and managed deployment profiles are not available yet, and we do not hold a SOC 2 report. For a security questionnaire, use the contact form.

Release controls

The current public release of Rambleproof is signed with the Developer ID Application certificate of Zena Labs LLC, notarized by Apple, stapled, and passes Gatekeeper assessment. Notarization is Apple's automated malware check of the build. It is not an endorsement or certification.

Every release goes through the same path. Production builds require Developer ID signing and hardened runtime, and the release script stops when signing, notarization, stapling, Gatekeeper, update feed, or license verification configuration is missing or invalid.

App updates use Sparkle and remain disabled unless an HTTPS feed and EdDSA public key are configured. The app requires a signed feed through SURequireSignedFeed. Updates install only after you choose to update, with signed downloads and verification before the app is replaced.

Third-party notices ship in the app, under Settings, Advanced, About.

Website controls

Download codes are six digits, expire after 10 minutes and are stored only as hashes behind a salted email digest. Five wrong attempts burn a code. Successful verification returns a short-lived, signed download token. Request and verification endpoints use same-origin checks and distributed limits and expose no account lookup signal.

Form and demo endpoints enforce strict body limits, timeouts and distributed rate limits. They fail closed when storage, providers or rate limiting are not configured. The demo checks audio container signatures and rejects risky cleanup. Security headers deny framing and unnecessary browser capabilities.

Report a vulnerability

Please use the contact formand put “Security” at the start of the message. Do not include credentials, transcripts or private customer data. We will provide a secure follow-up channel when needed.

Last updated: 12 October 2026.