Your messages stay on your Mac. Here's how we've built Dossier to safeguard your data.

• Dossier opens your messages in read-only mode. It cannot change, delete, or copy them.
• Only one conversation is read at a time, and only its 250 most recent messages.
• Phone numbers and email addresses are removed on your Mac, before anything is sent.
• When the filter cannot tell whether something is a phone number, it hides it.A masked date costs you a little polish. A leaked number belongs to someone who never installed Dossier.
• A person who is not in your address book is sent as REDACTED, never as a phone number.
• Automated senders are never read at all: two-factor codes, bank alerts, delivery texts, marketing.
• Anything your iPhone already marked as spam or junk is skipped.
• Emoji reactions are dropped before analysis.
• Your address book stays on your Mac. Names are matched there and nowhere else.
• A conversation you never run stays where it is. Nothing is sent in the background.
• When we stop using a piece of data, we delete it rather than leave it in the database.

• Everything travels over an encrypted connection.
• A dossier's title is encrypted on your Mac before it is stored. Our database holds only the scrambled form.
• Every account has its own key, so one person's app can never open another person's dossier title.
• A contact is referred to by a scrambled code, never by their phone number or email address.
• The secret that makes those codes is never written to the database. It is held in a separate system that only one part of our service can read.A stolen copy of our database is not enough to turn a code back into a phone number.
• Your codes are unlike anyone else's. Two customers who write about the same person produce two unrelated codes.
• Your sign-in token is kept in your Mac's Keychain, not in a file.
• Your key never syncs to iCloud and never rides along in a backup. It stays on the Mac that made it.
• Every update is signed. Your Mac installs one only if the signature is ours.

• Your message history is never stored by us. It is read to write the dossier, then it is gone.
• We do not log your conversation text. Not in a database, and not in an error report.
• Finished dossiers are cached on your Mac, in a folder only your account can open.
• What we keep is a short list: your credit balance, your date of birth, your email if you linked one, and a payment reference if you bought credits.
• Our usage records are counts only — how long it took, which model ran, whether it worked.No message text, no names, no contact codes.
• Every account can read only its own rows. The database refuses direct access from anywhere else.
• The key that runs the analysis lives only on our server. There is nothing valuable to pull out of the app on your Mac.

• Dossier is told to treat your messages as something to read, never something to obey.
• A message that tries to give Dossier orders is caught and wrapped before Dossier reads it.
• Dossier never receives a phone number or an email address. The scrubbing happens first.
• Your conversations are never used to train Dossier, or the model behind it.
• Dossier is instructed not to diagnose anyone or guess at their mental state.

• Cloud sync is off until you turn it on.
• Turn sync off and your cloud copies are deleted. The copies on your Mac stay.
• If that deletion fails because you are offline, Dossier keeps trying at every launch until it works.
• A dossier that fails to run refunds your credit automatically.
• You are asked how you know someone before the run starts, not after your credit is spent.

• You do not need to create an account with us to start using Dossier. No identifying email, no password.
• There is no password to steal. Linking an email uses a one-time link instead.
• If a sign-in link does not match the email you typed, Dossier rejects it and starts clean rather than sign you into someone else's account.
• Sign-in links are bound to our domain by Apple, so no other app can intercept one.
• Dossier is for ages 13 and up. A birthday under 13 is rejected and never stored.

• Your messages are never part of analytics. Not one word.
• Any reference to a contact is masked with a secret that never leaves your Mac.
• Crash reports carry the kind of error, never the contents of the request.
• We call our analytics pseudonymous rather than anonymous. The ID is random, but it is the same ID your account uses.
• Our analytics provider works out an approximate location from your network — your city.It comes from the network you are on, never from your Mac's location services. It is never an address.
• The website is counted separately from the app, in a system we cannot join to your account.
• The website sets no cookies and leaves nothing in your browser.
• A sign-in link has its token stripped before anything is recorded.

• Dossier is signed and notarized by Apple, and runs with macOS hardening turned on.
• The app asks for three permissions and nothing more.
• Every outside piece of code Dossier uses is locked to an exact version, so nothing changes underneath you.

• We wrote down who we defend against and who we do not, and we keep it current.
• Every change is reviewed for security before it ships, and every finding gets an answer on the record.
• If a claim of ours turns out to be too strong, we will correct it here.

Every page like this one lists what a product does. This is the part most of them leave out.

• Dossiers you sync are stored in a protected database. We have no operations that read it, but it can be read if needed.
• A dossier can quote short pieces of your messages, so a saved report holds a little of your text.
• Reports cached on your Mac are not encrypted by us. Apple's FileVault is the best control that covers them.
• A real person who spams you from a real phone number is not filtered out. Only automated senders are.
• We protect against specific kinds of AI attack, not every kind.
• Dossier titles are encrypted, so a title holding a phone number is never stored in clear text.This is not end-to-end encryption. We hold the secret its key comes from, so we could read a title if we chose to.