One network call. You can read it and switch it off.
Your files
Never leave the machine. There is no upload, no account, no sync, and no endpoint that receives them — we do not operate one. Conversions run on your CPU, in a sandbox with the network denied by the operating system.
Telemetry
None. No analytics, no crash pings, no feature flags, no identifier, and no setting to turn any of it off -- because none of it is in the build.
Network access
Two things reach the network, both starting with you: fetching an AI feature you chose, and replacing a model file this build pins differently from your copy. Spotting that costs no network -- it compares two local files -- so the only question is whether the app fetches it. That is Model auto update in Settings, the one network setting here; off, nothing dials out unless you press Download. Addresses come from the model registry in the build; every artifact is hash-checked against it and a mismatch is refused. No telemetry, crash reports, licence check or periodic call. Engines reach nothing, each sandboxed with networking denied by the operating system.
Stored locally
Config, history, recipes, the batch journal and the engine quarantine list, all under your user profile, all readable and wipeable. None can enable a capability: quarantine only ever disables, and no config key touches the network floor, because that key does not exist.
This website
Static files. No cookies, no third-party scripts, no remote fonts or images, no tag manager. A Content-Security-Policy blocks outbound connections and a build check verifies it. Any future analytics are self-hosted, cookieless, and disclosed in this paragraph.
Generated from one file shared with the README and the app's settings screen. The build fails if the three disagree.