Privacy & Security
DocGraph is built to run entirely on your machine. This section describes what that means mechanically — which is more useful than a promise, and occasionally less flattering. Where a guarantee has a boundary, the boundary is stated.
No telemetry, no account
Section titled “No telemetry, no account”There is no analytics, no crash reporting, no usage tracking, no device or install identifier, and no account system. Not disabled by default — absent. There is no code in DocGraph that reports anything about you anywhere.
The only request DocGraph makes on a schedule is the update check, which is on for a new install: about once a day, one check against GitHub (which may redirect to its download servers) that carries no version, platform or identifier, and that you can turn off (details).
What can leave your machine
Section titled “What can leave your machine”DocGraph refuses outbound connections by default. The requests DocGraph makes itself go through one internal checkpoint with two rules: anything off your machine must use HTTPS, and its host must be on a list for that purpose. A redirect may only lead to this computer or to one of DocGraph’s fixed download hosts (Hugging Face, pyke.io, GitHub), so an allowed host can’t hand a request on to an arbitrary one. A refused request never opens a connection.
Two kinds of request are not limited by a host list at the checkpoint. An Ollama on another computer is governed by its own switch, Allow remote Ollama (off by default), and may use plain HTTP (gap 7 below). Web search goes only to the search server you configured; that limit is enforced by the search feature itself, which is off until you turn it on.
The app’s own window can’t open connections by itself either: its content policy lets it reach neither the internet nor any port on your computer, so bundled code can’t talk to Ollama, a dev server or another app’s local API. Connections to local AI and search are made by DocGraph’s backend, behind the checkpoint.
Three kinds of connection don’t go through that checkpoint, because DocGraph doesn’t make them itself:
- Git push and pull are run by your system’s
git, to the remote you entered. DocGraph refuses unencrypted network remotes (http://andgit://), so your access token and notes are never sent unencrypted; use anhttps://or SSH remote, or a folder on this computer or a drive. Details. - App updates are fetched by the built-in updater from a fixed GitHub address over HTTPS, and every download’s signature is checked. Details.
- External agents open their own connections, which DocGraph can’t see (gap 2 below).
Git and update traffic still shows on the privacy badge and in the Activity log.
Everything that can reach the network, and what turns it on:
| What | Default | Turned on by |
|---|---|---|
| Local AI (the built-in runtime, Apple’s on-device model, or Ollama on your computer) | Off until you enable AI — then local | Nothing leaves |
| A cloud AI provider | Off | Saving a key, allowing the provider in a system dialog, and picking one of its models (details) |
| Ollama on another computer | Off | Allow remote Ollama |
| External agents | Off | Enabling a specific agent |
| MCP server | Off | Turning it on; it listens on your computer only |
| Web search | Off | Your own SearXNG service, and your approval of each query (or Allow in this chat for the rest of that chat) |
| AI model downloads | Off | Choosing a search language or a voice model (each asks first, with its size), or starting a chat-model download yourself. Files come from Hugging Face, or — for a link you paste — from that link’s host, for that one download only (details) |
| Ollama MLX check | Off | Clicking MLX? next to an Ollama model; sends only that model’s name to registry.ollama.ai |
| Model list refresh | Off | Clicking Check for new models in Settings → AI → Models & providers; sends nothing about you (details) |
| Git push and pull | Off | Adding a remote |
| App updates | On (daily check) | On by default; turn off Check for updates automatically and only clicking Check for updates checks |
| Release-notes pictures | Off | Clicking Load screenshots in the What’s new tab, or opening it with the daily check on (details) |
| Remote images, fonts and scripts in your pages | Off | A per-vault switch |
Where to go next
Section titled “Where to go next”| Page | For |
|---|---|
| The privacy badge | The pill in the corner: what each state means and what changes it |
| Privacy recipes | The settings for six common situations — local-only AI, cloud for some chats, keys in notes, sensitive clients, git, saved web pages |
| AI & your data | Where your notes go with each kind of AI, and what each asks first |
| Secrets & leak protection | Finding API keys in your notes, and stopping them leaving |
| Activity log | The record of every connection and AI run — and a test you can run |
| Pages you open | Why a note can’t run code or phone home by default |
| Encryption | Locking a note, or one passage, behind a passphrase |
| Sync & updates | What a git backup and an update check send |
| Settings & data reference | Every privacy setting and its default, and where DocGraph keeps data |
The honest gaps
Section titled “The honest gaps”Things a reasonable person might assume and shouldn’t:
- The search index is an unencrypted copy of your notes.
~/.docgraph/index/holds the text of every note you haven’t encrypted, in an ordinary database file. Full-disk encryption is what protects it today. - External agents are outside every mechanism here. They run under their own accounts, on their own connections. DocGraph checks the prompt it hands them and records that it started one — never what the agent sends. This is the largest path by which vault content can leave your machine.
- Secret scanning is partial. A vault scan reads HTML notes only; other files are checked when DocGraph saves them. Formats it doesn’t recognise are missed, and the default for outgoing content is to warn and send, not block. Details.
- Dismissing a page notice is permanent for that vault, and there’s no in-app way to bring it back.
- Links open with no confirmation in your browser.
- A web-search query is kept in full in the network log, and it may quote your notes.
- A remote Ollama may use plain HTTP on a local network, so prompts cross it unencrypted; allowing remote content in pages re-admits plain HTTP for those resources.
- Two tokens are kept in files, not the keychain: the MCP token and your git access token, each readable only by you. Cloud API keys are in the keychain.
- Clearing the network log keeps its older rotated file, and dismissed secret findings can’t be un-dismissed from the app.