Privacy and Security Model

Privacy and Security Model

Unspool is a local Telegram client. It has no QenTerra-operated backend, analytics, advertising, tracking pixel, crash-reporting SDK, or remote-code system.

Telegram necessarily processes authorization, chats, message history, and file requests sent through TDLib. Unspool does not make that service local merely by having a native interface.

Runtime network boundary

The shipping app sends runtime network requests through TDLib for:

• client configuration;
• account authorization;
• chat list and update loading;
• message-history scanning;
• selected file download;
• logout.

The development-only bootstrap separately downloads pinned TDLib and OpenSSL sources. That script is not runtime behavior.

Credentials and authorization input

• API ID and API hash are stored in macOS Keychain.
• The Keychain item is device-only and available after first unlock.
• Phone, email, codes, registration names, and two-step password are held in memory by the setup coordinator while needed.
• These authorization inputs are not deliberately written to Unspool's JSON stores.
• API hashes, codes, passwords, session data, and private chat content must not appear in logs or repository files.

App Sandbox

The generated target declares only:

• com.apple.security.app-sandbox;
• com.apple.security.network.client;
• com.apple.security.files.user-selected.read-write.

Unspool does not request broad home-directory or full-disk access. Destination access comes from a folder the user selects.

Security-scoped destination

The selected folder becomes a security-scoped bookmark stored in Application Support. Every planning, capacity, or placement operation resolves that bookmark and brackets access with start/stop calls.

The app verifies write access by creating and removing a small unique marker. A stale, moved, unavailable, or denied destination produces a recoverable error and requires a new user selection.

Diagnostic redaction

TDLib diagnostic JSON passes through an explicit sensitive-key redactor before logging. This is a defense against accidental disclosure, not permission to log arbitrary private responses. Product errors use short user-facing messages instead of dumping raw Telegram payloads.

Download trust

Sandboxing and filename safety do not make an attachment safe to open. Files come from Telegram and should be treated like any other external download. Unspool does not scan file content for malware.

Data deletion boundary

Sign out removes the saved API credentials after successful TDLib logout. It does not erase:

• downloaded files;
• local download history;
• attachment snapshots;
• preferences;
• the destination bookmark.

Complete local removal requires deleting the app's Application Support and preferences separately, then deleting downloaded files from the chosen folder.

For the complete policy and reporting process, read Privacy and Security.