Unplug the machine. Everything still works.

Every privacy policy says roughly the same thing, which is why almost nobody reads one. "We take your privacy seriously" is not a claim; it is a genre. The useful version is a test somebody can run.

Turn off the network. Does the software still do its job?

For Rutba Office the answer is yes, and that is not a feature we added. It falls out of a set of decisions that were each slightly harder than the alternative.

There is nothing to sign into

No account means no user record, no session, no password reset, no "we will email you a code". It also means we cannot build a profile of you, because there is no key to attach one to. That is a capability we gave up rather than a promise we are making.

It costs us the thing every consumer product wants: a way to count our users. We genuinely do not know how many people run it. The trade seemed obvious once written down.

Four things worth checking rather than believing

• Passwords go to the operating system. Mail credentials are handed to DPAPI on Windows, Keychain on macOS, libsecret on Linux — never written somewhere the application can read back in clear text.
• Message bodies cannot phone home. Mail renders in a frame with an empty sandbox: no scripts, no forms, no same-origin access. The content policy blocks remote fetches, so a tracking pixel cannot report that you opened the message. Remote images load only when you ask, per message.
• Deleting is not destroying. Removing a file moves it to the operating system trash. An office suite should never be the reason something is unrecoverable.
• Your documents never leave the machine. No sync, no cloud tier, no crash reporter, no document telemetry.

Every one of those is in published source, which is the point of publishing it. You do not have to take the list on trust; you can go and look at the line.

The one exception

An installed copy asks GitHub whether a newer release exists — twenty-five seconds after launch, then every six hours. One HTTPS request, carrying nothing we add. If a newer version exists it downloads in the background and installs when you next quit, never while you are working. Running from source never checks at all.

It is a setting. Turn it off and no request is made — not a smaller one, none.

And the honest limit of "collects nothing"

Any request to any server reveals an IP address and a user agent. So GitHub sees those when your copy checks for an update, and when you download an installer. We do not receive them and never see them — that is GitHub’s processing under their policy, not ours.

That is the truthful boundary of what "collects nothing" can mean for software able to update itself. Anyone claiming a stronger version is either not updating, or not telling you.