Offline-First Resilience & Security

Modern software often leaks sensitive financial and personal numbers to remote servers under the guise of cloud synchronization, AI autocomplete, or telemetry analytics.

Kalc is engineered with a strict privacy-first and offline-first ethos: your calculations belong exclusively to you, on your Mac.

---

Zero Telemetry & Complete Privacy

• No Remote Tracking: Kalc contains zero analytics trackers, tracking pixels, or diagnostic beacons.
• No Crash Telemetry: Error logs and crash traces stay on your local machine; nothing phones home.
• No User Accounts: There is no account registration, login wall, license activation server, or cloud subscription ping.
• Private Data Stays Private: Whether you are modeling corporate mergers, personal net worth, sensitive tax returns, or server credentials, your numbers never traverse the public internet.

---

100% Offline Computational Core

Every calculation subsystem in Kalc executes entirely on your Mac's CPU:

• Mathematical, Scientific & Transcendental Functions: Pure local execution.
• Date, Calendar & Timezone Conversions: Evaluated against macOS system timezone databases.
• Dimensional Unit Conversions: Computed via UnitCatalog with static physical ratios.
• Developer Functions & Cryptographic Hashes: Executed on-device via Apple's native CryptoKit.

You can take your MacBook on an airplane, work in remote off-grid locations, or run Kalc inside air-gapped corporate environments without losing calculation capabilities.

---

Offline Currency Store & Background Refresh

While currency exchange rates fluctuate continuously, Kalc ensures that an internet outage never interrupts your workflow:

1. Bundled Currency Baseline: Kalc ships with a pre-compiled local store of exchange rates for 170+ ISO currencies and major cryptocurrencies (BTC, ETH, SOL).
2. Offline-First Fallback: If your Mac is offline, Kalc calculates conversions seamlessly using the latest available cached rates.
3. Staleness Tracking: The header bar displays a live freshness badge:
   • Live: Rates refreshed recently.
   • 2h ago: Time elapsed since last update.
   • Offline: Operating in disconnected mode using local cached baselines.
4. Customizable Refresh Cadence: In Preferences > Rates & Daemon, you can configure the background update interval (e.g., every 6 hours, 24 hours, or manual refresh only).

---

Localhost-Only Daemon Binding (127.0.0.1)

The embedded calculation daemon (KalcDaemon) provides a headless HTTP REST API (POST /calculate) for integrations with Raycast, Alfred, and local terminal scripts.

To guarantee local security:

• Strict Loopback Binding: The daemon binds exclusively to IPv4 loopback 127.0.0.1:15055.
• No Remote Network Exposure: The service rejects external interface bindings (0.0.0.0 or local network IPs). Devices on your local Wi-Fi cannot access or invoke your calculation daemon.
• No Cross-Origin Exploitation: Rejects foreign origins and runs without elevated permissions.

---

Sandboxed JavaScriptCore Extension Engine

To prevent malicious or poorly written third-party plugins from compromising your system:

• Isolated JSContext: Extensions execute inside Apple's native JavaScriptCore runtime.
• No Filesystem Access: Plugins cannot read, write, or scan files on your disk.
• No Process Execution: Plugins cannot invoke shell commands, spawn child processes, or run binaries.
• No Outbound Sockets: Plugins cannot open raw network connections or exfiltrate document text.
• Controlled Bridge: Plugins communicate exclusively through the declarative kalc JS API to register custom functions, units, and templates.

---

Zero External Package Dependencies

The entire Kalc codebase compiles without pulling a single third-party Swift package, CocoaPod, or dynamic library. It depends strictly on Apple's standard system frameworks:

├── Foundation        (Decimals, strings, dates, regex, formatting)
├── AppKit            (Windows, views, layout, menus, dialogs)
├── TextKit 2         (Line fragments, text storage, baseline rendering)
├── Carbon            (HIToolbox system-wide global hotkeys)
├── Network           (Network.framework loopback HTTP socket)
├── CryptoKit         (MD5, SHA-1, SHA-256 cryptographic digests)
├── JavaScriptCore    (Secure extension sandboxing)
└── Testing           (Modern Swift Testing automated test harness)

By eliminating external dependencies, Kalc eliminates software supply-chain vulnerabilities, library bloat, and deprecation churn.