Code signing policy

Waffler is push-to-talk voice dictation for Windows and macOS, released under the MIT licence. The source is public at github.com/jbf-tars/Waffler and builds are published on the download page.

Waffler is a single-maintainer project. James Farrelly, who owns the repository, acts as author, reviewer and approver. The person responsible for code signing is the same person responsible for development and for the source repository. Two-factor authentication is enabled on the account that owns the repository and authorises releases.

Releases are never built or signed on a developer’s laptop. A release is cut by pushing a version tag, which triggers GitHub Actions workflows that build from that exact commit in the public repository. The workflow definitions are public and auditable, and every published file carries a SHA-256 digest recorded by GitHub that you can check against your own download. Only the Windows installer, built by these workflows from this repository, will be submitted to SignPath for signing.

Waffler is a dictation tool, so it necessarily touches your microphone, your keyboard and your clipboard. Being specific about that is more useful than reassurance:

• Microphone

  While Waffler is running it keeps the microphone open, so the start of your first word is not clipped. Only the last half-second is held, in memory, and it is thrown away unless you hold down your hotkey. A recording can include up to that half-second before you hold down the hotkey, and runs until just after you let go, or in hands-free mode until you stop it. The audio goes only to the speech-to-text provider you configured, under your own API key. The clean-up provider receives the text transcript, never the audio.

• Keyboard

  A global low-level keyboard hook detects your hotkey being held down and released. It acts only on your hotkey, plus Space (to lock hands-free recording while the hotkey is held) and Esc (to cancel a recording in progress). To auto-paste, Waffler sends a single paste shortcut (Ctrl+V or Cmd+V) to the app you were typing in. Keystroke content is never recorded, stored or transmitted. This is what makes push-to-talk work. Keyboard hooks and clipboard access are also what antivirus heuristics look at in an unsigned build.

• Clipboard

  Finished transcripts are placed on your clipboard so they can be pasted where you are typing. During first-run setup only, when you reach the API-key step, and each time you switch back to the setup window, Waffler checks the clipboard for an API key you have just copied, so you do not have to paste it by hand. Anything not shaped like an API key is discarded straight away: it is never shown, logged or stored.

• On your machine

  Your API keys, settings, dictation history and your most recent recordings live under ~/.waffler-hosted/ (%USERPROFILE%\.waffler-hosted on Windows) on your own computer. Recordings are kept only to diagnose transcription faults and are capped at the last 10, plus any recording that failed to send, which is kept in unsent/ until you delete it. You can delete them whenever you like. None of it is uploaded.

• No telemetry

  There is no analytics and no usage reporting of any kind.

The Windows installer puts the app in your per-user application directory and adds a Start Menu entry, plus a desktop shortcut if you tick that option. It does not add a launch-at-login entry, does not write to the Run registry key, installs no drivers or services, and does not change system-wide settings. The global hotkey is registered by the running app and released when you quit.

On Windows, use Settings then Apps then Waffler. On macOS, drag Waffler to the Trash. Either way ~/.waffler-hosted/ (%USERPROFILE%\.waffler-hosted on Windows) is left in place so your history and keys survive a reinstall. Delete that folder to remove everything.

Material changes to the app are recorded in the changelog. Changes to this policy are dated at the top of this page.