Safety and Privacy

Safety and privacy

What Distiller protects

• Recipes can't run commands on your Mac. A recipe, from the catalogue, a file or a link, is data: it can download files (checked by checksum or publisher signature), change a bottle's settings, ask you for files, and run Windows programs inside Wine. It can never run a program outside Wine or load code into your Mac.
• A recipe's paths stay inside its bottle, except folders you choose yourself.
• Only allowed settings. A recipe's environment settings are limited to Wine and graphics-layer tuning, and its winetricks components to an allowlist.
• Downloads are checked. Installers must match their recipe's checksum or, for installers that change with every update, carry their publisher's signature. Wine builds and graphics layers come only from their publishers' releases and are checked against the published checksums.
• Website links can't act alone. A distiller:// link only names a catalogue game and recipe, and nothing is installed until you confirm.
• Distiller's own updates install only when you choose, and only if the download matches its release's published checksum, is notarized by Apple, and is signed by the same developer as your copy.
• The AI assistant only reads, is off until you turn it on, and never listens on the network.
• Your GitHub account: Distiller asks only for access to public repositories, keeps the token in your keychain, and only ever opens pull requests from a new branch.

What it doesn't protect

• Wine isn't a sandbox. Windows programs, including the games you install, run with your permissions and can do anything you can: read and change your files, use the network. A bottle keeps one game's Windows settings apart from another's; it doesn't contain the game. Install games you trust.

Privacy

• No tracking. Distiller has no analytics, telemetry or crash uploads.
• Reports and submissions happen only when you send them. A report includes your Mac's chip, GPU cores, memory and macOS version, and nothing else about you.
• Network use is for what you ask for: the community catalogue (to browse and install), publishers' download sites (game installers, Wine builds and graphics layers; winetricks downloads Windows components such as fonts and runtimes from their publishers, Microsoft for most), GitHub's API (update checks, and the sign-in and submissions you make), and the publisher pages you open in the download window. None of it carries anything about you beyond what a web request does.

Reporting a security problem

Please don't open a public issue. See SECURITY.md for how to report a vulnerability privately, and what counts as one.