How StyleOCR keeps documents on your device and when optional local services run.

StyleOCR security architecture

StyleOCR is a desktop OCR application (Tauri-based) built around on-device recognition. The product goal is simple: your files are processed where you can see them—on your computer—without routing document content through StyleOCR-operated cloud OCR APIs.

Document scope

This page describes the intended design of the shipping app. Exact sandboxing, entitlements, and network rules can vary by platform build (for example macOS vs Windows) and release channel. When in doubt, inspect the privacy policy packaged with your build.

Trust boundaries

Boundary	What it protects	Typical controls
T1 · You ↔ StyleOCR	UI actions, file pickers, clipboard	OS user session; app code signing / notarization where applicable
T2 · StyleOCR ↔ files you choose	Source images & PDFs, exported documents	Explicit user selection; path access limited to what the OS grants the app
T3 · StyleOCR ↔ local services	MCP HTTP on localhost	Loopback-only listener; treat endpoint URL as sensitive on shared machines; no WAN exposure by default
T4 · StyleOCR ↔ the internet	Model downloads, app updates, billing	HTTPS to vendor CDNs or storefront APIs; only triggered by user-initiated installs, updates, or purchases

There is no trust boundary for “StyleOCR ↔ your mailbox” because the app is not an email client.

Architecture overview

Model downloads

Vision weights ship separately from the thin installer. When you install or switch a model, the app fetches bytes over HTTPS, verifies integrity where a manifest is provided, and stores files under application data directories on your machine. There is no design goal of uploading your corpus to StyleOCR for training from this workflow.

MCP server

The optional MCP listener lets compatible assistants talk to StyleOCR on localhost only. Enable it deliberately, restart after port changes, and avoid exposing the URL on shared computers.

Data handling summary

Data class	Typical storage	Notes
Task metadata & progress	Local database in app support folder	Describes jobs you created; not a cloud sync service
OCR / VLM output	Derived files you export or download	You control where they are saved
Model binaries	Cached under app-managed directories	Delete from Settings if you need space
Billing tokens	Handled by the storefront SDK	Subject to Apple / Microsoft / Stripe policies for that build

Sensitive content in your source documents (PII, financial, health) should be handled according to your policies—StyleOCR does not need account passwords for third-party mail servers because it never connects to them.

Secure engineering practices (high level)

Theme	StyleOCR approach
Minimize data	No central repository of user documents operated by the OCR feature set
Validate inputs	File-type checks, size limits, and safe parsing pipelines for images/PDFs
Supply chain	Signed releases; dependency pinning in the engineering repo
Local attack surface	MCP bound to loopback; disable the server when not needed on shared laptops

Frequently asked questions

Does StyleOCR upload my PDFs to the cloud for OCR?

The core pipeline is on-device. Network use is mainly for model downloads, app updates, and store billing when you use those features—not for routing every page through a project-operated cloud OCR API. Refer to your build’s privacy policy for any analytics or crash reporting details.

Can other people on my Wi-Fi call my MCP server?

By default the MCP listener is on localhost only. Remote access would require explicit OS-level tunneling or misconfiguration outside the app’s normal settings.

Is SQLCipher used for email storage?

No. Legacy documentation that mentioned IMAP / SQLCipher for mail described a different product shape. StyleOCR stores task state locally; it does not implement a mailbox sync engine.

For legal commitments about data, follow the Privacy Policy published on the StyleOCR website for your locale.

Security Architecture