Built to be trusted at the top of your screen.

The app

• Signed and notarized. Every release is signed with our Apple Developer ID, runs with the Hardened Runtime and is notarized by Apple. Debugging entitlements are never shipped.
• Signed updates. Updates come over HTTPS and must carry both a valid EdDSA signature from our update key and a valid Apple code signature. Updates are never gated by license, so security fixes reach everyone.
• Minimal permissions. NotchPulse never requests Input Monitoring or Screen Recording. Accessibility is requested only if you turn on notifications in the notch, and is used only to read and close notification banners. Other permissions are requested only when you enable the feature that needs them.
• Secrets in the Keychain. Integration tokens and license material are stored in your Keychain, on this device only, never synced and never logged.
• A local API that stays local. The socket is readable only by your user, rejects other user IDs, limits message size and rate, and validates every field. Links from scripts must be https:.

Licensing, without the DRM

• Each activated Mac gets its own P-256 key pair — in the Secure Enclave where available. The private key never leaves the Mac.
• Our server issues an Ed25519-signed entitlement bound to that key. NotchPulse verifies the signature locally with keys built into the app.
• License keys carry 100 bits of randomness and are stored on our side only as a SHA-256 fingerprint. They never appear in URLs or logs.
• Only a correctly signed message can turn Pro off. Outages, network errors, clock problems or local heuristics never do.

We’re candid about limits: no client-side licensing is uncrackable, and we won’t degrade the experience of paying customers trying to make it so.

Our servers

• Purchases are fulfilled only by signature-verified Stripe webhooks — never by a browser redirect.
• Card details are handled entirely by Stripe.
• Our servers receive license, device and purchase information only; never your content. See the privacy policy.
• This website runs no third-party code and is served with a strict Content Security Policy.

Reporting a vulnerability

If you believe you’ve found a security issue in NotchPulse, its update or license servers, or this website, please email support@notchpulse.app with “Security” in the subject line. Include steps to reproduce, the affected version and the impact you expect.

• We’ll acknowledge your report as quickly as we can and keep you updated while we investigate and fix it.
• Please give us reasonable time to release a fix before disclosing publicly.
• Act in good faith: don’t access other people’s data, disrupt our services, or test against licenses you don’t own. We won’t pursue legal action against good-faith research that follows these guidelines.
• With your permission, we’re happy to credit you when the fix ships.

Machine-readable contact details are published at /.well-known/security.txt.