Fair question. Here's how to check.
You should be careful with apps from sites you don't know. Each check below takes under a minute.
1 · Apple scanned it
Every release is notarized, which means Apple receives the app before you do, scans it for malware, and issues a ticket only if it passes. That ticket is stapled inside the app. If it had failed Apple’s scan, it could not be published here at all.
You will see the proof the moment you open it: a notarized app opens normally. If macOS ever says “damaged”, “unidentified developer”, or offers to move it to the Trash, do not bypass that — it means the file is not the one we published. Tell us.
2 · It is signed, and the signature names us
The app carries a Developer ID certificate issued by Apple to a real, verified identity. You can read it yourself. In Terminal:
codesign -dv --verbose=4 "/Applications/Mythral.app"
Look for an Authority=Developer ID Application line and TeamIdentifier=K9M5769L9H: the team ID is the developer's, and every release carries the same one. A signature cannot be forged, and it cannot be altered afterwards: change one byte of the app and it stops matching.
And to confirm macOS itself is happy with it:
spctl --assess --type execute --verbose=2 "/Applications/Mythral.app"
It should answer accepted · source=Notarized Developer ID.
3 · The file you downloaded is the file we built
Each release publishes SHA256SUMS.txt beside the download. Compare it:
shasum -a 256 ~/Downloads/Mythral-Apple-Silicon.dmg
If the number matches the one in the release, nothing was modified in transit.
4 · You can watch what it does on the network
This is the one that answers “is it quietly uploading my meetings?”, and it is the one we would check ourselves. Install a network monitor such as Little Snitch or LuLu, both well-known Mac tools, and watch Mythral while you dictate and record a meeting.
You'll see these requests, and no others:
- Once, during setup: the models download from Hugging Face, the public host for open machine-learning models (huggingface.co and its file servers). The English dictation model and the speech model always; the notes model and the speaker model if you turn on meeting notes; and a 1.3 GB quick model on 8 GB Macs. About 3.7 GB together, and never again.
- Once a day: a request to this website asking whether a newer version exists. It carries the app’s version number and nothing else. This website passes it on to github.com, and when there is an update, it downloads from github.com too.
There is no analytics library in the app, no crash reporter, no account, and no server of ours for your words to go to. Your transcripts never leave the machine, because there is nowhere for them to go.
What it asks permission for, and why
- Microphone — to hear you. Obviously.
- Accessibility — to type the words into the app you are using. This is the permission that lets it place text at your cursor; it is also the permission that would let any app read your screen, which is exactly why macOS makes you grant it by hand. Mythral does use it to read a little: the text just before your cursor, names on screen and in email addresses, and a terminal's recent text when you're talking to an AI coding tool like Claude Code. Those are spelling hints, read on the Mac and forgotten after the dictation. Password managers and banking apps are never read.
- Screen Recording — macOS files “capture the audio my Mac is playing” under this name. It is how the other people in a call are heard. No screen is captured, ever, and you can confirm that with the network monitor above: nothing is uploaded.
- Calendar — optional, and only to name meetings and fill in who was there.
- Contacts — optional, offered at the end of setup. Names become spelling hints and never leave the Mac.
- Reminders — optional, and only to add the action items you choose.
- Meeting app window — only while recording, and only who is speaking, so the other people are named. Can be turned off.
- Input Monitoring — only if you pick a single key such as Fn as the shortcut, so the app can notice that key in other apps.
If something looks wrong
Tell us, or use Help › Report a Problem inside the app. A security issue should not go in a public issue: email security@mythral.dev, and it will be treated before anything else.