Privacy policy
Last updated August 2026.
This website
bitshout.app is a static site. It has no accounts, no login, no contact form, no comment system, no advertising and no third-party analytics. Nothing you do here is associated with an identity, because there is no identity to associate it with.
The site loads one external resource: web fonts from Google Fonts, which receives your IP address and user agent as a consequence of serving those font files. No other third-party host is contacted; the site's Content Security Policy actively prevents it.
The web server keeps ordinary access logs — IP address, timestamp, requested path, response status, referrer and user agent — for operational and security purposes. These are not combined with any other source and are not used to build a profile.
No cookies are set by this site.
The BitShout application
BitShout is local-first. Policy, grants, credential references, security evidence, diagnostics and containment decisions remain on your Mac by default.
What BitShout processes
Only the metadata a containment decision requires:
- protected subject identity, and process identity and lineage
- code-signing metadata
- relevant filesystem paths and resolved resource identity
- network endpoint metadata — hostname, IP, port, protocol, direction, verdict
- execution target metadata
- authorization requests and grant scopes
- capability identifiers
- Vault runtime manifest metadata
- setup and component health
- redacted security evidence
What BitShout does not do
- collect file contents for the purpose of policy evaluation
- require packet payload inspection for the planned network filtering model
- provide mandatory remote telemetry
- automatically upload diagnostics
- expose reusable credentials to protected applications or Vault guests
Evidence and export
Security evidence is stored locally, redacted before it is written, versioned, and hash-chained. Exporting it is an explicit action you take, and the export is redacted. There is no automatic transmission path.
Credentials
Credential secrets referenced by the capability broker are held by macOS Keychain and remain broker-owned. They are used to perform an approved operation and are never handed to a protected application.
Contact
Questions about this policy or about how BitShout handles data can be sent to privacy@bitshout.app.
Changes
Material changes to this policy will be reflected in the date at the top of this page. The policy describes current behaviour; it is not a statement of intent about future versions.