Security

What Dolly keeps, and where.

Dolly records and edits on your Mac. A few things do go online when you ask for them: a shared link, an account, a purchase. This page lists each one, where it's kept, and how it's deleted.

Your Mac first

Dolly has no cloud for your videos. Recording, transcription, editing and export work without a connection, and we never see what you make unless you share it.

Stays on your Mac

Your raw recordings: screen, camera, microphone and system audio
Your projects, edits, looks and exports
Transcripts, captions, titles and chapters: made on your Mac
Every video you never share
Connect your AI: it talks to Dolly over 127.0.0.1 on your Mac

Goes online, only when you act

Get link: a 1080p web copy of that one video, its poster frame and captions (or the stills of an interactive demo)
Checking your license with Lemon Squeezy, and once a day a look for updates on GitHub
Signing in, if you choose to use an account
Nothing else: no analytics, no crash reports, no AI calls

What Dolly links keep

Dolly links run on Cloudflare: the files in R2, Cloudflare's object storage, and everything else in D1, its database. Viewers don't need an account, and watch pages ask search engines not to index them.

WhatExactlyWhere

The videoA 1080p web copy of the video you sharedR2

Poster, captions, previewThe poster frame, captions if you made a transcript, and a short preview animationR2

Title and settingsTitle, description, chapters, button, expiry, and whether comments, replies and downloads are onD1

Comments and reactionsThe name a viewer typed, the text, the moment, and the emojiD1

Video repliesThe recording a viewer chose to post, its poster frame, name and lengthR2 and D1

VisitorsA salted, shortened SHA-256 hash of the visitor's IP address and browser. Never the IP address itselfD1

Who made the linkA SHA-256 hash of your license key (during the beta, of your Mac's Dolly install) and of the link's private manage token. Never the key or the tokenD1

ReportsIf a viewer reports a link: the reason, their note and the same visitor hashD1

Encryption

We describe this the way our providers document it. Dolly adds no encryption layer of its own on their servers.

In transitEvery connection uses HTTPS: watch pages, uploads from the app, the account and checkout. Cloudflare secures traffic to R2 and D1 with TLS.

At rest, Dolly linksCloudflare encrypts R2 objects and D1 databases at rest with AES-256 in GCM mode. Sources: Cloudflare R2: data security, Cloudflare D1: data security.

At rest, accountsSupabase states that all customer data is encrypted at rest with AES-256 and in transit with TLS. Source: Supabase security.

Passwords and who can change a link

Link passwords are never stored. We keep a salted PBKDF2-SHA256 hash (10,000 rounds), and a visitor gets 10 tries per 15 minutes. The right password opens the video in that browser for 12 hours.

Only the Mac that made a link can change or delete it. It holds a private manage token; the server keeps only a SHA-256 hash of it.

Links are random: 8 characters, about 2 × 10¹⁴ possibilities, not listed anywhere.

Accounts

An account is optional; Dolly works without one. If you make one, it lives in a Supabase project in Frankfurt (eu-central-1) and holds:

Your email address. You sign in with a one-time code, so there's no password to store
Each Mac you activate: the name you see in its settings and a SHA-256 hash of its hardware id
The licenses and orders bought with your email, copied from Lemon Squeezy

On your Mac, the account file is encrypted with AES-256-GCM using a key tied to that Mac.

Payments

Lemon Squeezy sells Dolly as merchant of record: it takes the payment, handles tax and sends the invoice. Your card or PayPal details go to Lemon Squeezy, never to us. We receive the order and the license. More: Lemon Squeezy as merchant of record.

The app and its updates

Dolly is signed with its own code-signing certificate. It isn't notarized by Apple yet, which is why macOS asks you to choose Open Anyway the first time (see Install help).

Updates come from Dolly's public release page on GitHub. Before installing one, Dolly checks that the download matches its published SHA-256 checksum, and that the app inside has Dolly's bundle id and is signed with Dolly's own certificate. If anything doesn't match, the update is refused and removed.

Deleting

Delete a link in Dolly and its video, poster, captions, comments, reactions, video replies and view counts are removed from R2 and D1 right away.
A link that expires is removed 7 days later, so you have time to extend it.
Uploads that never finished are removed after a day. Daily visitor marks are kept for about a day, then deleted.
Delete a comment or a video reply in Dolly and it's gone, files included.
Remove a Mac from your account on the Account page. Deleting the whole account is done by hand for now: write to security@getdolly.app from the address you sign in with.

Certifications

Dolly has no security certifications of its own: no SOC 2, no ISO 27001. For their parts we rely on what Cloudflare, Supabase and Lemon Squeezy document, linked above.

Is Dolly links up right now? See Status.

Report a security issue

Found something? Write to security@getdolly.app. Please give us a reasonable time to fix it before you share it.