Voxmill offline

How to check that Voxmill works offline

Check for yourself what Voxmill sends to the internet.

The recording, the transcript, the file name and the path stay on your computer. The app connects by itself only to the addresses in the table, with no analytics or usage counter. Three ten-minute tests show it.

For Apple computers. Windows: in development. Notify me.

Every connection Voxmill can make

Voxmill connections: address, when and what it sends
Address	When	What it sends
`api.polar.sh`	When you enter a Pro or Team key.	The key, Tenzan Logic's organisation id and a computer fingerprint (a hash from which you cannot read back the computer's number or the account).
`api.polar.sh`	Once 30 days have passed since the last confirmation of the key: at every start, and every 6 hours while the app stays open. Sooner when the computer's clock is set back by more than a day. When you enter the same key again, remove the key or enter a different one. After the server refuses the key twice, between a day and 30 days apart, to give its activation back.	The key, the organisation id and the activation number. No fingerprint.
`tenzanlogic.com`	When the app starts, and every 24 hours while it stays open. At the first launch it starts only after the licence and privacy step.	A request for one small file that names the newest version, the same for every copy. The server sees your IP address, as for any page you open. Nothing else about you, your files or your computer. About itself it gives only the name and version of the update component.
`tenzanlogic.com`	When you choose “Update and restart”.	Once more, the request for the small file that names the newest version, then a download of the update file, both with the same information about itself. The app checks the update file's signature before it replaces itself.
`tenzanlogic.com`	Only with your consent (“Send reports” at the first launch, or “Send anonymous error reports” in Settings). It sends them when the app crashes, a file fails, a model will not load, an update fails, and once a session when the Pro model runs without its Neural Engine file.	One small JSON object with twelve fixed fields (app and system version, chip, memory, window language, an error code and a few more), up to 2048 bytes. No file names, paths, text, key, email address or installation number. One attempt, no retry.
`huggingface.co`and a download server in the hf.co domain	When you click the model download button in the app window.	Your IP address, the name of the file requested and the program name “voxmill”. Each address is pinned to one version of the file, and the app checks the file's SHA-256 checksum.
`github.com`and a download server in the githubusercontent.com domain	When you download the models for speaker labels (Pro): the voice model from here first, the model that splits the speakers only when the download from huggingface.co fails.	The same data as above. Two files sit on GitHub as release files, and the app checks the SHA-256 checksum of each.

“Buy Pro”, “Open the buyer's portal” and the links in the Help menu open your browser or your mail app, only when you click. The browser or the mail app makes that connection, not Voxmill. The buy page gets from the app only which product to show, a tag for the visit and the window language.

If the server at api.polar.sh refuses a key twice at the check after 30 days, between a day and 30 days apart, Voxmill removes the key from this computer and, at the next start or the next 6-hourly check, asks api.polar.sh to give its activation back; if that request does not get through, it tries again at every start and every 6 hours. Other rare cases, such as a key that belongs to another product, are described in the Voxmill privacy notice.

Ten minutes, three tests

You type the commands in Terminal (Cmd+Space, type Terminal). Nothing is installed. Run the tests after the first launch, when the models are downloaded.

Test 1: the app's signature

It shows who signed the app, whether Apple checked it and which permissions are written into it.

codesign --verify --deep --strict --verbose=1 /Applications/Voxmill.app
spctl --assess --type execute --verbose=4 /Applications/Voxmill.app
codesign -d --entitlements - /Applications/Voxmill.app
codesign -dv --verbose=4 /Applications/Voxmill.app 2>&1 | grep -E "Authority|Notarization|TeamIdentifier"

The result, key lines:

/Applications/Voxmill.app: valid on disk
/Applications/Voxmill.app: satisfies its Designated Requirement
/Applications/Voxmill.app: accepted
source=Notarized Developer ID
[Key] com.apple.security.device.audio-input
Authority=Developer ID Application: SZYMON JEDRYCZKO (Q6V5THS7X3)
Notarization Ticket=stapled
TeamIdentifier=Q6V5THS7X3

That is the one permission in the signature: the microphone, for recording. A missing network entry does not mean the network is closed: Voxmill does not run in Apple's sandbox, so the system does not restrict it. That is why tests 2 and 3 exist.

Test 2: connections while it works
It shows how much data the app sent and received. Quit Voxmill (Cmd+Q) and type the command. Open the app, wait a few seconds and drop a recording into the window. Stop the command with Control+C.
```
nettop -p voxmill-desktop -p voxmill-worker -p ffmpeg -p voxmill-summary -J bytes_in,bytes_out -L 0 -s 1
```
The result: one process, voxmill-desktop, with a few kilobytes received and a few hundred bytes sent right after the start (the update check). During a transcription the numbers stand still. The processes voxmill-worker, ffmpeg and voxmill-summary do not appear, because none opens a connection. Instead of nettop you can use a firewall that asks about every connection (LuLu, Little Snitch).
Test 3: working with no network
The system closes the network to the app, and the transcript is made all the same. Quit Voxmill (Cmd+Q) and start it like this:
```
sandbox-exec -p '(version 1)(allow default)(deny network*)' /Applications/Voxmill.app/Contents/MacOS/voxmill-desktop
```
Drop a recording into the window, then quit the app (Cmd+Q). The restriction applies to this one launch, and the app uses your usual data and models.
Check that the command really closes the network:
```
sandbox-exec -p '(version 1)(allow default)(deny network*)' curl -sS -m 8 https://tenzanlogic.com/
```
```
curl: (6) Could not resolve host: tenzanlogic.com
```
In the log (Help menu, “Show the Log”) you will see the line update: check failed, network. The system refused the update check; transcription does not need it.

What we measured

What we tested: Voxmill 0.3.7, the signed and notarised app this site served on the day of the measurement. Measured on 14 October 2026: macOS 26.6.2, a laptop with an Apple M2 chip, the free version (the Lite model). One file with 11 seconds of speech and one with 8 minutes.
Test 1: All four commands gave the result listed above.
Test 2: Ten launches under nettop and lsof at the same time: eight with the 11-second file, one with a file in the Opus format (which ffmpeg reads), one with the 8-minute file. In each, one connection, right after the window opened, and none afterwards. lsof showed the address tenzanlogic.com (compared with dig +short tenzanlogic.com). In each launch, 511 bytes sent and 6105 bytes received (nettop). The server does not always send back the same amount: in five more launches the app received up to 6229 bytes. With the 8-minute file the numbers did not change during 16 seconds of transcription. The processes voxmill-worker and ffmpeg had no connection.
Test 3: Three launches with the network restricted and eight without gave the same transcript and the same word timings (the SHA-256 of the text and word timings compared). With the restriction the log held “update: check failed, network”; without it “update: none on offer”. With the restriction nettop and lsof showed no traffic. The Opus file gave the same transcript both ways.
Summaries (experimental): We ran voxmill-summary from this version's package by hand, on a sample conversation (15 remarks, three people), with a model file that has the same SHA-256 as the app's. The window starts it only with summaries on and a Pro or Team key, which we did not have. With the network and without it, the result was the same, byte for byte, with no connection in nettop or lsof.

The limits of this test

A test, not a guarantee: Apple marks sandbox-exec as deprecated (DEPRECATED in its manual page), so a newer macOS may behave differently or drop it. The results are for Voxmill 0.3.7 on macOS 26.6.2; a new version needs a new test.
Only the app: The test covers Voxmill and the programs it starts. A notes folder in iCloud Drive, OneDrive or Dropbox is uploaded by that service, not by Voxmill. Backups such as Time Machine copy the files Voxmill wrote.
What we did not run: Downloading models, confirming a key, updates and error reports need the network, so with the restriction they do not work. We measured an ordinary transcription in the free version, with one update check; we know the other connections from the code and the privacy notice and did not trigger them in these tests.
What it measures: The network. The test does not prove the app has no bugs, and it does not replace an independent audit: Voxmill has none.

Download free

For law firms: Voxmill in law firms