Zero network calls
Your script never leaves the Mac.
Eyeline is sandboxed and ships without a network entitlement, so macOS itself refuses to let it open a connection. That is a stronger claim than a privacy promise, because you do not have to believe it. One command against the app bundle settles the question.
The architecture
Does Eyeline upload my scripts anywhere?
No, and the reason is structural rather than a policy we wrote down. Eyeline ships with exactly two sandbox entitlements, and a network client entitlement is not one of them. Without it, the operating system denies any outbound connection the app attempts, whether we intended one or not.
Most privacy pages ask you to trust a company. This one asks you to trust the macOS sandbox, which is enforced by the kernel and is the same mechanism the App Store relies on. There is no server to switch off, no setting to get wrong, and no incident that could change the answer next year.
Here is the entire network surface of the app, listed in full.
com.apple.security.app-sandboxPresentThe app runs inside the macOS sandbox, so the kernel, not the app, decides what it may touch.com.apple.security.device.audio-inputPresentMicrophone access for voice sync. Requested at runtime, and only if you enable it.com.apple.security.network.clientAbsentThe entitlement an app needs to open an outbound connection. Eyeline does not have it.
Verification
How do I verify that myself?
Run one command in Terminal against the copy of the app on your own disk, and read the entitlements it prints. Everything the app is permitted to do is in that list.
$ codesign -d --entitlements - /Applications/Eyeline.app
Executable=/Applications/Eyeline.app/Contents/MacOS/Eyeline
[Dict]
[Key] com.apple.security.app-sandbox
[Value]
[Bool] true
[Key] com.apple.security.device.audio-input
[Value]
[Bool] trueTwo keys, and the list ends there. If you would rather not read a plist, ask the question directly and watch nothing come back.
$ codesign -d --entitlements - /Applications/Eyeline.app 2>/dev/null | grep network
$ # nothing. there is no network entitlement to find.Point a network monitor at Eyeline afterwards if you want a second opinion. It will stay empty, because the sandbox refuses the connection before a packet is ever formed. The same posture is why the panel stays out of screen captures: both are enforced by macOS rather than by the app, which ishow the invisibility works as well.
What happens to your data
Where does Eyeline store my scripts?
In plain JSON files in a local folder on your Mac. You can open one in a text editor, copy it to a backup drive, or delete it in Finder. Nothing syncs, nothing uploads, and there is no proprietary database you would need an export feature to escape.
Does voice sync send my audio to a server?
No. Voice sync uses Apple SFSpeechRecognizer in its on-device mode, so recognition happens on your Mac and keeps working with Wi-Fi switched off entirely. Eyeline requests microphone permission only if you turn voice sync on. Leave it off and the app never asks.
Is there an account, telemetry, or crash reporting?
None of the three. There is no sign-up, no license check that phones home on launch, no analytics SDK, and no crash reporter. This is not restraint on our part so much as arithmetic: with no network entitlement, there is nowhere for any of it to go.
Does Eyeline need Accessibility permission?
No. Global hotkeys are registered through Carbon RegisterEventHotKey, which does not require the Accessibility permission, so Eyeline never asks for control of your Mac or the ability to read other apps. The microphone, for voice sync only, is the single permission it can ever request.
The exception
So what does touch the network?
Buying it, and nothing after that. Checkout on this website runs through Stripe, which handles the card details, and this site then emails you a download link and serves the DMG. That exchange happens between your browser, your email, and this website.
The app takes no part in any of it. It does not know a purchase happened, does not check a license on launch, and has never opened a connection in its life. The website is a shop, the app is a tool, and they do not talk to each other.
What the website itself collects, which is your email address for the receipt and the download, is written out in theEyeline privacy policy. Refund terms live on the refunds page.
Two things we will not gloss over
The DMG is not notarized yet
Eyeline 1.0 is ad-hoc signed and has not been through Apple notarization, so Gatekeeper will warn you on first launch. Right-click the app, choose Open, and confirm once. We would rather tell you here than let it surprise you after you have paid.
Buying is not anonymous
To send you a download link we need an email address, and Stripe sees the payment. That is a website transaction and it is the only personal data in the whole product. Nothing about it ever reaches the app on your Mac.
Confidential scripts
Is Eyeline safe for confidential material?
The useful question is not whether we promise discretion, but whether the app has any mechanism to leak. It has no network path, so an earnings call script, a deposition outline, a diagnosis you are about to deliver, or a board update stays on the machine that wrote it.
We are not claiming a compliance certification, and you should be suspicious of a $19 app that does. The claim is smaller and checkable: two entitlements, no network client, on-device speech, local JSON files, no account. Your own disk encryption and device policy still do the work they always did.
If the material is sensitive enough that you are reading this page, the other half of the problem is who can see your screen. Eyeline handles that too, and thesurface by surface breakdown of what stays hidden is the other half of the answer.
Questions
For the people who check.
See the full feature list, thesetup walkthrough, or thegeneral FAQ for everything that is not about privacy.
Could an update quietly add network access later?
An update would be a different build with a different signature, and its entitlements would be visible to the same codesign command. The copy on your disk cannot change under you, and Eyeline has no auto-update mechanism, because auto-updating would require the network access it does not have.
Can I run Eyeline on a machine with no internet at all?
Yes. Download the DMG once on any machine, move it across, and the app runs indefinitely offline. Voice sync, timed scroll, hotkeys, and script editing all work with no connection, because none of them ever used one.
Does my IT team need to allowlist anything?
No domains, no ports, no endpoints. Eyeline is a sandboxed app with two entitlements, app-sandbox and device.audio-input, and no network client entitlement. A reviewer can confirm the whole surface with one codesign command against the bundle.
How is the app delivered after I buy it?
As a 2.4 MB universal DMG downloaded from this website, for macOS 14 or later. It is ad-hoc signed and not yet notarized by Apple, so the first launch needs a right-click and then Open. After that it opens normally.
A teleprompter with nowhere to send your words.
One payment of $19 for macOS 14 or later. Two entitlements, no network client, no account, and a command you can run to check.
macOS 14 or later. 2.4 MB. Works on Apple silicon and Intel.