The short version
SiloDraft collects no data. None.
No analytics. No telemetry. No account. No personal data. No usage metrics. No error beacons. No advertising IDs. No fingerprinting. No crash reports. No data of any kind is collected, stored, transmitted, or shared by SiloDraft about you, your device, or your documents.
Everything SiloDraft does — contract drafting, playbook indexing and compliance checks, clause generation, clause-level redlining and compare, OCR ingestion, and export — runs entirely on your Mac, on-device, using a bundled local runtime and locally-stored open-weights Gemma language models. There is no cloud component. There is no server. There is no SiloDraft account.
What we don't have, and therefore never see
Because SiloDraft has no server-side component, the following do not exist anywhere in our infrastructure (and our infrastructure consists of: nothing):
- Your name, email, phone, or address.
- Your IP address, device identifier, MAC address, or any other hardware fingerprint.
- The contracts you draft, the playbooks you index, the compliance flags and risk analyses SiloDraft produces, the clause alternatives it generates, the redlines it compares, or any file you import or export.
- The contents of your Documents, Downloads, Desktop, or any other folder.
- Session timing, feature usage, button clicks, or any other behavioural data.
- Crash reports. SiloDraft does not implement a crash-reporting SDK.
We never see any of this because none of it is ever sent. The app does not phone home, ever.
The local backend is not a network service
SiloDraft runs a small local Python (FastAPI) process to perform playbook retrieval, compliance checks, clause generation, and document comparison. It binds strictly to the loopback interface (127.0.0.1:8765), never to a public or network-facing address. The SwiftUI host renders the editor in a WKWebView loaded from that same loopback origin. This is on-device inter-process communication (IPC) only — a private channel between the macOS document layer and the on-device engines. It accepts no external connections and is not reachable from your network or the internet.
Outbound traffic you initiate
Three classes of outbound network traffic can originate from your Mac while SiloDraft is running. None of them go to SiloDraft. All of them are user-initiated:
- Model weight downloads. The first time you generate a clause alternative or run a compliance check, SiloDraft downloads the Gemma language model weights from a public open-weights repository — Hugging Face or ModelScope. The download is anonymous by default; no token, account, or registration is required. Once the weights are on disk, every check, clause draft, and compare after that is fully offline.
- Mac App Store updates.When Apple ships a SiloDraft update, the Mac App Store delivers it. This traffic is between your Mac and Apple's servers, governed by Apple's privacy policy. SiloDraft is not involved.
- Links you click. If you click an external link inside the app (for example, opening this privacy policy), your default browser handles the request. SiloDraft is not involved.
Permissions we request, and why
SiloDraft requests no special macOS permissions. No Microphone, no Camera, no Screen Recording, no Contacts, no Location, and no Full Disk Access.
- File access. SiloDraft only touches files and folders you explicitly open or import through the standard macOS sandboxed file pickers — a contract you open, a scanned PDF you ingest, a playbook you index, or a folder you export to. The sandbox prevents access to anything you have not chosen.
OCR of scanned PDFs and image-based contracts runs through Apple Vision entirely on-device — the document never leaves your Mac to be read.
On-device data you create
The drafts you write, the playbooks you index, the compliance audits, clause alternatives, and redlines SiloDraft produces, and your local preferences live on your disk under ~/Library/Containers/com.silosystems.silodraft/Data/Library/Application Support/SiloDraft/ (plus any folder you explicitly choose to export to). They are yours. We do not have access to them. Deleting SiloDraft removes the app; your work remains under its container until you delete it manually.
Children's privacy
SiloDraft is rated 4+ on the Mac App Store. Because no personal data is collected from any user, no special treatment is required for users under 13. Same policy applies regardless of age: nothing collected.
Third-party services
SiloDraft uses these open-source components and public services. None of them receive any data about you from SiloDraft:
- Gemma models (open-weights language models, used under the Gemma terms of use) — run locally via mlx-lm to generate clause alternatives and risk analysis.
- MLX / mlx-lm(Apple's on-device array/ML framework and its language-model runtime) — run locally.
- FastAPI (Python web framework) — runs locally on loopback as the on-device backend.
- Apple Vision OCR(Apple's on-device text recognition) — runs locally to ingest scanned documents.
- Hugging Face Hub / ModelScope — contacted only when you run a step for the first time and the model weights are downloaded.
Changes
If we ever materially change how SiloDraft handles data — for example, if a future version of the app ever begins to collect anything at all — we will publish an updated version of this page, announce the change prominently in the release notes, and require explicit consent in-app before any new collection begins. The effective date at the top of this document reflects the current policy.
The current policy is: nothing is collected.
Contact
Questions about this policy: admin@ohmslaw.net
For non-private inquiries you can also open an issue at github.com/flowmar47/SiloDraft.