Security, explicitly

No Full Disk Access, administrator privileges, SIP changes or private window-management APIs are part of the design. Tools must preserve originals and export to a new destination.

License proofs are signed with Ed25519, bound to an installation hash and expire after seven days. This is offline tolerance for verified buyers, never a trial. Refund revocation takes effect on the next successful validation, or at proof expiry while offline.

Transfer uses short-lived pairing, Mac consent and hash verification. HTTPS signaling still depends on internet access. Security review, mobile interoperability, update signing and notarization remain release gates.

Known limit: the Transfer page your phone opens is served by our server. File contents never reach it, but a compromised server could serve a modified page; HTTPS, a strict CSP and no third-party scripts reduce that risk, and the verification code lets you detect a different Mac.