Security review notes

Built to be easy to review before work use.

Your voice and transcribed text never leave your Mac. Optional anonymous usage stats (counts & timings only) are on to help improve the app — turn them off anytime.

Permissions

Microphone for voice. Accessibility/Input Monitoring for hotkey and paste. No Screen Recording in V0.

Network model

No cloud transcription in the shipped product path. Local servers bind to loopback only.

Diagnostics

Raw audio and transcripts stay local unless the user explicitly exports them for support.

Release integrity

Public builds must be Developer ID signed, notarized, stapled, and published with SHA-256 checksums.

Website analytics

The marketing site records anonymous page and CTA events only. No cookies, person profiles, autocapture, or session replay.

Before public release, RambleFix also needs the signed DMG, notary profile, embedded runtime audit, dependency/SBOM review, third-party model notices, and a clean-machine install test.