Security

Where your text goes

When you press the shortcut, the selected text goes over an encrypted connection to our server, hosted on Railway in the EU. The server adds the instructions for the action you chose and forwards the text to Anthropic's Claude API. The answer streams back through our server to you, word by word. Our server keeps nothing: the text, the result and the instruction are never written to disk or to logs.

Anthropic processes the text under its commercial API terms: no training on your data, and a retention period of up to 30 days for abuse monitoring only.

Where your voice goes

Read aloud sends the text to ElevenLabs, which turns it into speech and streams the audio back through our server. Dictate sends your recording to ElevenLabs for transcription, then the transcript goes to Claude to become clean written text. ElevenLabs runs with zero data retention for us: recordings and generated audio are deleted when the request is done and are never used for training. The microphone is only on while you hold or toggle the dictate key.

What we store

• An anonymous device token, stored hashed. It is created on first launch and lives in your Keychain, Windows Credential Manager or browser storage. It is not linked to a name or an email.
• Usage counts per device: time, action, number of characters or seconds, duration, success or failure. They enforce the free daily allowance and are deleted after 12 months.
• A salted hash of your IP address, for rate limiting.
• Your email address if you join the Pro waitlist.

Transport

Every connection, from the app to our server and from our server to Anthropic and ElevenLabs, uses TLS.

Own API key

If you enter your own Anthropic API key in Settings, the text features skip our server entirely. Your computer talks to Anthropic directly, and we never see the text or count the action. Read aloud and dictation still go through our server, because the voice service is shared.

What the apps can access

• macOS: Accessibility permission, so the app can read the text you select and paste the result back. Microphone permission, used only while you dictate. Nothing else is requested.
• Windows: the app reads the selection through UI Automation, with a copy and paste fallback through the clipboard, and pastes the result the same way. The microphone is used only while you dictate.
• Web reader: only the text you paste and, if you allow it, the microphone while you dictate.

What we don't do

• We don't read your screen or watch what you type. The app sees text only when you select it and press the shortcut.
• We don't log keystrokes.
• We don't train models on your data, and neither do our providers.
• We don't show ads or sell data.

Code signing and notarization

The Mac app is signed with a developer certificate but not yet notarized by Apple, so macOS shows a warning the first time you open a copy saved by a browser. The Windows installer is not yet code-signed, so SmartScreen shows a warning too. Both are on our list. Until then, every installer is published as an asset of a public GitHub release in the repository 69Olle69/rewrite4me-releases, so anyone can check the file they downloaded against the release.

Open questions

We are a small company and this is a beta. We have not had an external security audit yet. If something here is unclear, or you think we have got something wrong, write to us.

Reporting a vulnerability

Email security@zimplfy.io with what you found and how to reproduce it. We answer within 5 working days and tell you when it is fixed. There is no bug bounty yet. Please give us time to fix the problem before you publish it.

Deleting your data

Deleting the app removes the device token from your computer. To have the device record and its usage counts removed from our server, email privacy@zimplfy.io with the device ID shown in Settings. Waitlist emails are removed on request.