Privacy

OpenFolio is designed as a zero-network production app. It reads Messages locally, stores a separate local search index, and runs exact and semantic retrieval on the Mac. It has no account, telemetry, hosted AI, cloud sync, remote model fallback, automatic updater, or browser-based sign-in.

What OpenFolio reads

• The local Messages database, read-only, after you grant Full Disk Access.
• Apple Contacts, only if you choose to allow access, to resolve message handles to names.

OpenFolio does not send, edit, delete, or back up messages.

What OpenFolio stores

• A local SQLite archive and search index.
• Local embeddings created with the bundled q8 all-MiniLM-L6-v2 model.
• Local settings and optional contact matches.

These files live in macOS Application Support, separate from the app bundle. They remain in place when you manually replace the app with a newer version.

Exact claim boundary

The production code and packaged app enforce a deny-all network policy covering Internet, LAN, loopback, DNS, socket, navigation, download, and external web handoff paths. Exact search remains available if the bundled semantic model is missing or unavailable; the app does not fetch a replacement.

The stronger public statement that a particular signed release makes zero network requests remains gated on inspecting that final signed artifact and observing every process in its tree with PID-attributed traffic instrumentation on real macOS. Source review, unit tests, CSP, and an unsigned local build are not enough to prove that release claim. Until that gate passes, treat the zero-network behavior as the implemented and tested contract, not a verified claim about every signed binary.

Updates

OpenFolio does not check for updates or open a release page from inside the app. To update, download a new release yourself and replace the app in /Applications. Your local archive stays in Application Support.