Privacy policy.

The short version

Citebound runs no analytics, no tracking, and no servers of its own. The data associated with you is your own workspace content. With Citebound Pro, that content syncs through your private iCloud (CloudKit) database, which is what the App Store privacy label (“User Content, linked to you”) reflects. Silo Systems cannot read it. Without Pro, your library stays on this Mac.

No third-party analytics, telemetry SDKs, usage beacons, advertising identifiers, or crash-reporting trackers. No outside AI service receives your questionnaires or evidence unless you enable the optional cloud rewording described below and choose a provider.

Document parsing, text extraction, passage matching, cited drafting, the citation checks on approval, and export all run on your Mac, and none of them uses a language model.

CloudKit Architecture & Sync

Citebound Pro syncs your workspaces, including imported evidence text, across your Macs through your private Apple iCloud account. Sync runs automatically while you subscribe to Pro and are signed in to iCloud; without Pro, nothing is synced:

• Apple-hosted Private Database: Sync records are stored only in your private database in the iCloud.com.silosystems.citebound container.
• No Custom Backend: Silo Systems operates no server, database, or proxy for Citebound. We cannot view, access, or restore your CloudKit records.
• Encryption in Transit and at Rest: All CloudKit traffic and storage are encrypted by Apple in accordance with Apple's iCloud security standards.
• You settle conflicts: When two Macs have changed the same workspace, Citebound shows the conflict and you choose which copy to keep. Nothing is overwritten silently.

Document Processing & AI Privacy

Imported questionnaires (CSV or TSV) and evidence documents (PDF, plain text, Markdown) are treated as untrusted input and parsed on-device inside Citebound's sandboxed container. Citebound reads the text layer of a PDF and does not run OCR, so a scanned page without selectable text is not read.

Rewording a cited draft is optional. On macOS 26, on Macs that support it, the Mac's built-in on-device model can do it, and that text stays on your hardware. You can instead use a model server running on this Mac, such as Ollama or LM Studio. Citebound accepts only a localhost, 127.0.0.1 or ::1 address for that server, so those requests stay on the Mac as well.

Optional Bring Your Own Key (off by default)

Apart from Citebound Pro sync to your own private iCloud container, cloud rewording is the only way your content can leave your Mac, and it is off until you choose it. If you select a cloud provider under Settings, Answer Engine, Bring Your Own Key, and enter your own API key for OpenAI, Anthropic, Google Gemini, or OpenRouter, then each time you reword an answer Citebound sends that question and the evidence passages it cites to that provider, under your account. The provider's privacy policy and retention rules then govern what it receives.

Before a cloud provider becomes active, Citebound shows a consent dialog, and a cloud badge stays visible while one is selected. Requests travel directly from your Mac to the provider: Silo Systems runs no relay in this path and never receives your content or your key. The key is saved in this Mac's Keychain. Matching, drafting, approval, and export never involve the provider, and you can switch back to on-device rewording in Settings at any time.

Monetization & StoreKit

Citebound is a free download. One questionnaire of your own is free from import to cited export, and the bundled demo does not count toward it. Citebound Pro is an auto-renewing subscription at $29.99 a month or $299.99 a year. Purchases, receipt checks, and subscription management go through Apple's StoreKit and your Apple Account; Silo Systems receives no payment details.

File System & Sandbox Access

Citebound operates inside the standard macOS App Sandbox. It accesses only:

• Files you select: Questionnaires and evidence files you choose in the standard macOS open and save panels or drag onto the window.
• Application Support: Local workspace state stored at ~/Library/Containers/com.silosystems.citebound/Data/Library/Application Support/Citebound/.
• Outgoing connections: Used for iCloud sync with Citebound Pro and for a rewording provider or local model server you configure. Nothing else.

Export always asks where to save a new file. Citebound never overwrites or edits the questionnaire you imported.

Data Control & Deletion

You remain in full control of all evidence and questionnaire data. Deleting a workspace removes it and its extracted evidence text from this Mac; if it was synced, the deletion reaches your iCloud database at the next sync while you subscribe to Citebound Pro and are signed in to iCloud. Removing an evidence document takes it out of the workspace, and that change reaches iCloud the same way. Deleting the app does not remove its local container, its iCloud records, or a saved API key, so delete your workspaces and remove any key in Settings first.

Children's Privacy

Citebound is a professional software workspace rated 4+. Silo Systems collects no personal data from anyone who uses it, minors included.

Changes & Contact

If material changes are ever made to how Citebound handles data, this policy will be updated with an explicit version note.

v1.1 (2026-09-23): the policy was corrected to describe the optional outbound paths accurately.

v1.2: states that iCloud sync is part of Citebound Pro, corrects the description of on-device processing (drafting uses no model; only optional rewording does), and describes the local model server rule and the questionnaire formats.

For privacy inquiries or technical questions regarding this policy, contact us at: admin@ohmslaw.net