RELEASE NOTES

The release this line was cut for: the tunnel no longer outlives the app. Force-quit it or let it crash and the tunnel closes with it, rather than leaving the whole machine going out through the exit with no window left to press Disconnect in. Plus the preset screen catching up to the phone.

• Close the app, close the tunnel. A service component that survives the app undoes everything the moment the app is gone; if a route could not be removed at once, the next launch finishes it. Proven on the machine.
• Presets have a line that fits them, and you can write your own. The card no longer prints one sentence over everything; the Description field lets you say what a preset is for.
• A bigger icon grid with the premium glyphs shown in the same block — greyed and locked, but they still open the plans. Nothing that was free became paid.
• "Move your server here?" is a picture now, not a wall of text — and offers to take the place without moving your one home server.
• Choosing how you connect marks your own choice apart from the fastest one.
• Without a subscription, exactly one preset works; a paying subscriber is never locked out by this while offline.
• Windows ships this version too. The tunnel there already closed with the app — its service has done that since 0.9.2 — so what is new on Windows is everything else above: the preset screen, the description you write yourself, the icon grid, the picture instead of the wall of text.

A same-day repair of 0.9.1 on Windows: that build could not connect at all. Nothing else changed, and the macOS build is rebuilt from the same source so the two platforms stay one version.

• Windows 0.9.1 could not connect, and 0.9.2 can. It was packaged against the development privilege path instead of the installed service, and that path cannot create the tunnel adapter without administrator rights — which is how every installed copy runs. The app looked healthy while connecting to nothing.
• A build made that way no longer compiles, so the mistake cannot be repeated by hand or by a script: the packaging flag is now checked by the compiler rather than remembered from a document.
• If you installed 0.9.1 on Windows, install 0.9.2 — the update inside the app could not offer you a fix, because a build never offers you the version you already have.

Windows arrives, and macOS gets the same build. Signed, and it installs and runs without administrator rights — the privileged half is a service that checks who is calling before it does anything. This build also fixes what a first real Windows session found: the app did not compile there at all, because the tray was switched on for Windows in one place and left switched off in another.

• Windows is a download now, not a promise. 10/11, 64-bit, signed by DUOSDIGITOS LLC and timestamped. A fresh install brings up its own service and connects as an ordinary user — no administrator prompt at connect.
• A tray icon, and the window comes back from it. Closing the window hides it and leaves the tunnel up; the icon returns it. ⚠️ Windows 11 files a new tray icon under the arrow rather than on the taskbar, so the first time the window hides, the app says once where it went — and never again.
• Start with Windows is a switch in the tray menu. It survives “Disable” from Task Manager honestly: Windows records that in a second place, and the switch reads both, so it no longer reports “on” for something Windows refuses to launch.
• The app can install its own updates on Windows. The service verifies its own copy of the package — our signature, the digest the backend published over TLS, and a refusal to move backwards — before anything runs.
• Connecting no longer waits on a timer that already expired. The step that waits for the engine asked its question only after sleeping 400 ms, so it could never answer faster than a multiple of that. On a cold start this cost about 0.8 s.
• Both sheets with a pinned bottom stop cutting a row in half. Plans and Settings now fade the last rows into the page as they reach the buttons, so a cut-off line reads as “there is more below” instead of a rendering fault.
• macOS ships the same version — the fixes below that are not Windows-specific (the cut-off rows, the pin row of a session the app did not start, the connect timings) are in the Mac build too, signed and notarized by Apple as always.
• A live session that this app did not start is described properly. The pin row used to vanish entirely — no toggle, no “this is your server” — when the tunnel was raised by something else. Those facts are now read back from your profile.

First beta. Settings and your account split into two screens, the way they are on the phone; the app heals a broken start on its own; and the alarm that says the tunnel dropped finally fires when a repair gives up. macOS is Apple silicon only — the installer refuses on Intel rather than installing something that cannot run.

• Settings and your account are two screens now. The gear beside the search bar opens Settings — subscription, feedback, country, language, privacy. The person icon at the top of Settings opens your Profile — your subscription in detail, your email, your devices, and account deletion. Before this they were one screen wearing the title “Profile” while holding the language and privacy rows; splitting them is the last big way the app still read differently from the phone.
• The connect screen and its cards were re-measured against the phone and match it now — the search bar and its gear, the card corners and the way they press, the text sizes, the version line. Thirty measurements, eight of which were off before this.
• The app heals a broken start on its own instead of waiting for you to restart it. A failed country list retries, the “this network is censored” path keeps trying behind the banner, and a start that fails offers Retry — the same five-second recovery the phone already had.
• When a repair gives up, you are now told the tunnel is down. The app stays quiet while it is trying to repair — that part shipped before — but if the repair fails, the alert that says your traffic is no longer protected now actually fires. It never did: the repair was consuming the very moment the alert was meant to fire on.
• Measuring your best place twice no longer leaves you with two “Games” profiles, and the hold switch releases your server. Every re-measure used to mint another profile; now it re-points the one you have and keeps the name you gave it. Turning off “hold this server” actually lets it rotate again, and the machine is remembered across the off — turning it back on does not cost you another measurement.
• Signing out stops offering you premium-only places. The premium grant used to survive sign-out and outlive a restart, so a signed-out person was still shown premium regions and refused at connect. It is dropped as part of signing out now.
• Deleting your account leaves the account screen instead of leaving you on a “Profile” page for an account that no longer exists.

The server you keep gets a name, an account page that lists them, and a way to find out which country is actually fastest from where you are.

• Your server has a name now. When you keep a server, the connected screen says “This is your server” instead of “Pinned” — and the country list marks the one holding it with “Your server is here”, so you can see it without connecting first.
• Your account page lists your home servers. How many you hold, which machine each of your devices keeps, and a Release button for any of them — including a device that is switched off somewhere else. A reservation that is no longer actually held is marked “Not held” rather than counted as if it were.
• A profile for gaming, and a way to find out which country is fastest for you. It is set up from the profiles gear rather than the main screen, because setting it up takes a run of tens of seconds and walks your device across countries. SafePlace measures every place offered to you, shows each result as it arrives, and names the one that answered fastest from where you are — then keeps you on that exact machine, so the route does not move in the middle of a match. What is measured is the leg from you to the exit; the leg from the exit to a game server is not ours, so nothing here promises a low ping in any particular game. The run cannot be taken while you are connected, and it says so rather than quietly dropping your session to measure.
• The “Server Rotation” row is gone, from the connected screen and from profile settings. It sat next to the server you keep and described the same thing from the other side — and when you keep a server, nothing rotates at all, so the row could say “On” over a session that was not rotating. Keeping a server is now the only control, and it says what it does.
• Connecting from a throttled network no longer just stops. Where a network slows our server down instead of blocking it, SafePlace now moves to a second address rather than waiting out the same stalled one twice — and where your region is known to need it, it starts there instead of finding out the hard way. Until now this app had no second address at all. Honest limit: this is proven working against the live service, but it has not yet been timed from inside a throttled network, so how much faster it makes a bad connection is still unmeasured.
• A development binary was being packaged into the signed app. Harmless in itself — a Windows-only stub that does nothing on macOS — but it had no business shipping, and the check meant to stop it could only recognise the binaries that existed when it was written. The package is now trimmed to what the product actually is, and proven to carry nothing else.

SafePlace moves into the menu bar, and stops being quiet about the two things you need to know.

• SafePlace lives in the menu bar. A small S at the top of the screen shows whether the tunnel is up without opening anything: a ring when it is off, a broken ring while it is connecting, a filled circle when it is on. Its menu carries the country you are connected through, how long the session has run and how much has passed through it, a connect/disconnect button, and your connection profiles — so switching profiles no longer needs the window.
• Closing the window no longer quits. The window hides into the menu bar and the tunnel keeps running; click the icon, or the Dock icon, to bring it back. Quitting is now an explicit act — ⌘Q, or Quit SafePlace in the menu.
• You are told when the tunnel drops on its own. This matters more now that the window can be hidden: without it, a tunnel that dies while SafePlace sits in the menu bar leaves you believing you are protected when you are not.
• You are told when a new version is out, once per version, and the offer appears in the menu-bar menu as well as in Settings. Until now the app asked the release server exactly once, at launch, and put the answer three clicks deep — so an app that had been open since before a release never learned about it. That is how 0.3.4, which fixed connecting outright, sat unnoticed for hours.
• Launch at login, off by default, as a switch in the menu-bar menu. It writes a plain launch agent in your own Library folder — you can see it and delete it by hand.

The release that made the previous two work. If you are on 0.3.2 or 0.3.3, update.

• Connecting works again. In 0.3.2 and 0.3.3 pressing Connect ended with “Another VPN is already active” even with no other VPN installed — on both macOS and Windows. The tunnel adapter came up, and then the app never installed the routes that send traffic into it; its own safety check noticed the traffic was not going through the tunnel and stopped, which is the right thing to do with the wrong cause. One line had been dropped during an internal refactor two releases ago. Verified on real machines, both platforms: the tunnel establishes and traffic exits through the chosen country’s server.
• A network hiccup no longer turns into a red error on the first try. After the Mac wakes from sleep the Wi‑Fi takes a few seconds to reconnect, and any request fired into that window failed instantly. Startup and connect requests now get one second attempt after a short pause. Requests that change something on the server — registering the device, refreshing the session — are only repeated when the connection was refused outright, never when the server may have already acted on the first one.
• The diamond of tint on the globe is gone. On the first screen — the one every user sees before touching anything — the map painted a shape between Africa’s coast and the edge of the globe that is not land. The cause turned out to be the map data, not the drawing: in the shipped coastline file Africa–Europe–Asia and Antarctica were a single outline, joined by a strip half a degree wide running down the international date line. They are now separated, and the land is cut at the horizon rather than smeared onto it.

A Windows repair. Superseded by 0.3.4, which fixed connecting.

• Console windows no longer flash while the app is open (Windows). Every reading the app takes from the system — the adapter, the routes, the byte counters behind the speed figures — runs a console helper, and a windowed app that starts one gets a black window for the length of the call. The speed figures alone refresh once a second, so the desktop strobed for as long as SafePlace was running.

One repair you can see, and the first Windows build ever run on a real machine. Superseded by 0.3.4.

• A network failure no longer prints the address it was calling. When a request could not reach the server, the message on screen carried the whole link — including your device id and the endpoint. It read like a diagnostic and was really the plumbing showing through. Now every such failure says plainly that the network could not be reached. Same class of leak as the 0.3.1 note, from four more places.
• Windows: the tunnel connected but carried nothing. The bundled tunnel component accepted packets, opened the connection to the engine, sent its greeting — and the engine received not one byte. Adapter up, routes ours, server healthy, no traffic. Anyone who saw “connected” on Windows and no working internet was seeing this.
• Windows: the app called itself a Mac. A Windows install appeared as mac-<host> in the device list and asked the update service for macOS packages — which would have offered a .pkg to a Windows user.
• Windows: the window was see-through, and country routing had no data. The body was deliberately 8% transparent so macOS could blur what is behind it; Windows has no such blur, so it simply showed the desktop. Separately, the geography database was missing from the Windows bundle, so routing by country had nothing to route by.

A repair, and the instrument that should have existed to find it.

• An error message no longer prints the address it was calling. A failed request used to show the full link on screen — including the one that hands out your VPN configuration. Anyone who saw a screenshot saw that link. Failures now read as plain sentences.
• The app keeps a diagnostic log, and can hand it over. Until now a build launched normally wrote its diagnostics nowhere at all. Privacy & Data has a new Share diagnostic log: it gathers the logs into one file on your Desktop. Links and credentials are removed on the way out — a log you send to someone should not carry the keys to your account.

The first build that can update itself, and the first that knows who it is.

• The app updates itself. It asks whether it is still the current build and, if not, downloads and installs the new one. The plain download link stays one click away whenever that path fails.
• An update is tied to a specific build. The installer checks the package fingerprint, not only that the package is ours — otherwise "install an update" could also mean installing an older build with known holes.
• Each device now carries its own secret, alongside the app credential. It ships inactive: nothing is enforced until every client carries one, so no existing install can be locked out.
• The connected view now matches the iPhone app field by field.
• A release build states which environment it was built against, so a test build cannot be mistaken for a production one.

Self-updating has not yet run end to end in the wild: 0.3.0 is the current build, so it has nothing to offer itself. The first real exercise happens on the next release.

The build that became installable by a person rather than by a developer.

• Notarized by Apple and stapled, in two passes, so the app inside the disk image carries its own ticket. With one pass macOS complains on first launch.
• A real installer. It sets up the background service even when an older one is running, and places the app in Applications instead of asking you to drag it there.
• The rotation switch in a preset now actually reaches the engine. It had been connected to nothing.
• Fixed the band across the globe, and the dark continent opposite it — one defect, not two.
• Failures now reach you, in your own language, instead of failing silently.
• The window stopped behaving like a browser tab.

First packaged build — the work that turned an empty shell into a working client.

• A real connection: pick a region, press Connect, and traffic leaves through the chosen server.
• The interface, rebuilt to match the iPhone app — including the interactive globe.
• Sign-in by email code, so a subscription follows the account rather than the machine.
• A background service that holds the connection and repairs it without being asked.
• Signed with a Developer ID, which is what lets macOS open it at all.