Security
What you paste stays on your Mac
Developers paste tokens, logs, keys and customer data into tools all day. This page says, in plain words, what leaves your Mac, how the secret scan works, where your keys live and what has to be true before the app updates itself.
What leaves your Mac
The tools send nothing. This is everything else.
DailyUtil has no server of its own in the path of what you paste. This is every place the app talks to, and when.
| To | What is sent |
|---|---|
| Nowhere, for every tool | Formatting, decoding, hashing, generating and clipboard detection run on your Mac. So does Apple Intelligence. |
| The AI provider you chose | The tool's input, after the secret scan, when you press an AI button with a cloud key. Straight from your Mac, never through us. |
| Our payment provider | Your licence key and a label for this Mac, to check the licence. Nothing you paste. |
| cdn.dailyutil.app | Nothing is sent. The app downloads one small file to see whether a newer version exists. |
| dailyutil.app | The app's name, version and build channel, to ask for announcements. No licence key, account or device id.(not in the app yet) |
| The host you typed | Network tools such as DNS lookup and HTTP requests send exactly what you built, only when you press Run.(not in the app yet) |
The full wording, with when each connection happens, is on the privacy page.
A secret scan before every cloud request
Before input goes to a cloud AI provider, DailyUtil looks for keys, tokens and passwords in it, on your Mac.
- Provider keys, private keys, JWTs, bearer tokens, passwords in URLs and env lines
- Nothing is sent until you choose: mask, use Apple Intelligence, or send as is
- A JWT goes only as its decoded header and payload
Keys live in the Keychain
Your licence key and AI keys are stored in the macOS Keychain, through one place in the code.
- This Mac only, no iCloud sync
- Never in settings files, history, logs or the pasteboard
- A saved key is never shown again
Pasted text is untrusted
What you paste is data. It is given to an AI model as text to read, apart from the instructions, and an answer never acts by itself.
- AI never replaces your input without a click, and Undo brings it back
- AI output never runs, opens or sends anything
- Network tools send only on Run, even when AI filled them in
Previews are locked down
The HTML and Markdown previews, when they ship, show content with scripts and link navigation off and a strict content policy.
- Scripts can be turned on for one preview, by you
- No page in a preview can reach your files
Our website cannot control the app
The one thing dailyutil.app will be able to do is show a notice in the app. The app decides what it accepts.
- Plain text only, with a length limit
- Links only to dailyutil.app, over https
- An answer that does not fit shows nothing
The licence check fails safe
If the licence server cannot be reached, your plan stays as it was. Only a definite "no" changes it.
- No network never locks you out
- A lapsed plan locks the Pro tools, never the free ones
- Test switches are ignored in a released app
Updates
Four checks before a new version is installed
An app that updates itself is a way in, so the update has to prove where it came from. If any check fails, nothing is installed and the version you have keeps running.
- 1
The list of versions came from our own download server and names a higher version than the one you have.
- 2
The download carries a signature made with a key that never leaves our release Mac, and it matches the public half built into the app.
- 3
The unpacked app has a valid Apple code signature, from our Apple developer team, for DailyUtil itself.
- 4
The new app says it is the version that was promised.
Reporting
Found a security problem?
Write to [email protected] with what you found and how to see it. Please give us time to fix it before you publish it. The machine-readable version of this is at /.well-known/security.txt.
Related reading: Keeping secrets out of AI prompts and How to decode a JWT safely.
Get DailyUtil
Put the toolbox on your Mac
Free for eight tools, with no time limit and no account. Needs macOS 14 or later on Apple Silicon and Intel.