How we handle your machine
and your data

On your machine

• Services bind to localhost. Your sites and databases are not exposed to the network unless you deliberately share a live link.
• A live link is temporary and explicit. It exists only while you have it switched on for that project, and closing it removes the public URL.
• The local certificate authority stays on your Mac. Its private key never leaves the machine and is not known to us. It signs only your local hostnames.
• Administrator rights are asked for narrowly — writing hosts entries and trusting the local certificate authority — and only when the action needs them.
• Bundled binaries are pinned and signed. The app does not download and execute code from the internet at runtime.

What leaves your Mac

Two things, and nothing else:

• A licence check. Your licence key and a device identifier, so we can tell three Macs from three hundred. It fails open: if our server is unreachable, the app keeps working.
• Anything you send us on purpose — a contact message, or diagnostics you choose to export and attach.

There is no analytics SDK in the app, no crash reporter phoning home by default, and no inventory of your projects, code or databases. We could not tell you what you are working on.

On our side

Reporting a vulnerability

Write to security@localsoft.app with enough detail to reproduce it. We will confirm receipt within two working days and tell you what we intend to do.

We will not threaten you with legal action for reporting something in good faith, and we are happy to credit you when the fix ships. Please give us a reasonable window before publishing, and do not access other people's data while testing.