Your Sidedoor
Your Sidedoor writes to people in your name, so it should be easy to see exactly what it does with your data. Everything on this page describes how the software works today, and the source code is public so you can check it.
Your resume, profile, drafts, message history and applications are stored in a folder on your own computer. There is no Sidedoor account and no cloud copy of your search.
Your AI key and license key are kept in macOS Keychain or Windows Credential Manager, not in plain files, so they stay out of backups and synced folders.
Outreach passes through our relay on its way out and is not stored. The relay's log records only which kind of request it was and whether it worked.
Drafting uses your own AI key, so your resume and drafts go straight from your computer to the AI provider you choose, not to us.
Every piece of data Sidedoor handles, where it lives, and who can see it.
| Data | Where it lives | Who can see it |
|---|---|---|
| Resume, profile, answers | A folder on your computer | You. It goes to your chosen AI provider only when a draft or answer is written. |
| Drafts and message history | A folder on your computer | You. Messages pass through our relay when they're sent; the relay doesn't store them. |
| AI key and license key | Keychain (Mac) or Credential Manager (Windows) | You. They're never written to our logs. |
| Your license | Our relay, as a one-way hash of the key | Us: whether your subscription is active, and up to two device IDs (salted hashes, not your hardware serial). |
| Your linked messaging account | Our relay, as an account ID | Us: the ID only, so each request can be limited to your own account. |
| Payment details | Stripe | Stripe. Your card never touches our servers. |
The dashboard listens only on your own machine (127.0.0.1), never on your network. It needs a secret token unique to your install, and it rejects requests that come from other websites, so a web page you visit can't reach it or act through it.
Every request to our relay is checked against your license, and the relay itself fills in which account the request is for. One user can't read or send through anyone else's account, even by crafting their own requests.
License confirmations are cryptographically signed (Ed25519) and checked by the app, so they can't be forged. If you go offline, Sidedoor keeps working for up to 72 hours on the last confirmation.
Everything Sidedoor sends over the internet (to our relay, your AI provider, Stripe and our update check) goes over HTTPS.
The app contains no analytics or crash-reporting services. Our website uses Cloudflare Web Analytics, which sets no cookies. "Report a problem" copies a summary to your clipboard with keys, emails, names, links and personal details removed; nothing is sent until you paste it yourself.
In Review mode, no message goes out until you approve it. You can switch modes any time in Settings.
The full source is public on GitHub under the Business Source License, so anyone can read exactly what it does.
Both apps carry a code signature that ties them to a publisher whose identity Apple and Microsoft have checked. If anyone altered the app after it was built, the signature would break and your computer would warn you.
The Mac app is signed with an Apple Developer ID certificate issued to David Omofonma (Team ID WX74LWM685), with Apple's hardened runtime and a secure timestamp. Before each release it is notarized: Apple scans it for malicious software and issues a ticket, which is attached to the app so your Mac can confirm it even offline.
Check it yourself: in Terminal, run spctl -a -vv /Applications/Sidedoor.app. It should say accepted, source=Notarized Developer ID.
The Windows installer and app are signed through Microsoft's Trusted Signing service, which issues certificates only after verifying the publisher's legal identity. The signature names David Omofonma, chains to Microsoft's Identity Verification root, and is timestamped by Microsoft, so it stays valid after its short-lived certificate rotates.
Check it yourself: right-click the installer, choose Properties, then Digital Signatures; the signer is David Omofonma. Because Sidedoor is new, Windows SmartScreen may still show a notice until the app builds up a download history; the signature is what proves who made it.
Each download on our GitHub releases page has a matching .sha256 file, so you can confirm the file you downloaded is exactly the one we published.
Sidedoor never updates itself without asking. It checks a small version file on yoursidedoor.com and shows a banner. On a Mac, "Update now" replaces the app only after checking the download's fingerprint, Apple's signature and notarization, and that it comes from the same developer as the copy you have. On Windows you download the new installer yourself.
| Service | What it does |
|---|---|
| Stripe | Payments, subscriptions and invoices |
| Your AI provider | Writes drafts and answers, on your own key and your own account with them |
| Fly.io | Hosts our relay and its small license database (United States) |
| A messaging delivery partner | Delivers the outreach you send, under your own linked account |
| Cloudflare | Cookie-free visit counts for this website |
| GitHub | Hosts the source code and downloads |
The Keychain and Credential Manager keep your keys out of backups and synced folders, but other software running under your own computer account can still read them, as it can any file you own. Keep your operating system up to date, turn on FileVault (Mac) or BitLocker (Windows), and only install software you trust. Uninstalling Sidedoor and deleting its folder removes your data from your computer; to cancel billing, use the billing link in your welcome email.
Please email support@yoursidedoor.com with "Security" in the subject, and don't post it publicly until we've had a chance to fix it. Thank you.
Last reviewed against the source code: October 27, 2026.