Privacy & local-first design

The promise: there is no Orifold document server. Your PDFs, their text, and your workspace activity are not uploaded. The few outbound requests Orifold can make are explicit, narrow, and never carry document contents.

Here’s the proof.

Everything runs on your Mac

Every document-processing feature — import, page organization, text and object editing, annotation, OCR, compression, encryption, signing, form filling, translation, and export — executes on-device. There is no cloud document-processing path to opt out of.

The exact network boundary

Orifold has three network-capable flows:

Updates. A manual check—or automatic checks only after you enable them—asks GitHub for the latest release metadata. A release downloads only after you choose Download. See Update & uninstall.
Signing timestamp candidates. If you enable the optional timestamp while applying a digital signature, Orifold contacts the chosen RFC 3161 timestamp authority. The request contains a SHA-256 hash of the signature bytes, never the document or its text. Current builds do not embed or mark the returned candidate until full CMS/PKI trust validation is available; they warn and export PAdES B-B instead. See Sign documents.
Translation language models on macOS 15+. After Orifold’s first-use disclosure, macOS may download a requested language model from Apple. Once the required model is installed, Apple’s Translation framework processes the document text on this Mac. See Translate selected text or a page.

None of these flows uploads a PDF or sends document text to an Orifold service. Orifold has no service capable of receiving it.

Sandboxed by design

Orifold runs inside the macOS App Sandbox with exactly four entitlements:

com.apple.security.app-sandbox
com.apple.security.files.user-selected.read-write
com.apple.security.files.bookmarks.app-scope
com.apple.security.network.client

The file entitlements mean Orifold can only read and write files you explicitly select — it has no standing access to the rest of your disk. The app-scope bookmark lets the Recently Viewed shelf reopen a file you already granted access to, without asking again — the access you gave, remembered, nothing wider. The network entitlement is outbound-only and supports the three flows above; the sandbox has no way to scope it per-host, so the honest scoping is in the code — which is open for you to read.

Zero telemetry

There is no analytics pipeline in Orifold, and no server to send data to even if there were. Usage isn’t measured, tracked, or reported.

Verify it yourself

Orifold is open source. Read the code, watch network activity while using the app, and check the entitlements file directly in the repository. With automatic update checks disabled, expect no document-workflow traffic unless you explicitly download an update, request a timestamp candidate, or let macOS fetch a translation language model.