Core AI processing
PrivateAI sends the system prompt, conversation context, current request, selected Tool schemas, and Tool results to the user's local Ollama service. The checked-in App does not configure a cloud model provider. Ollama is a separate local process with its own configuration and data handling.
Each user turn includes a compact snapshot of local date and time, UTC offset, time zone, locale, up to three preferred languages, macOS version, and processor architecture. The task retains that same snapshot across Tool rounds. It excludes device and account names, serial numbers, and location; locale is not treated as location.
Data stored on the Mac
Conversations and messages are stored in a local SwiftData database. Selected documents are copied to content-addressed managed storage under ~/.privateAI/artifacts. Whole-document analysis checkpoints are stored under ~/.privateAI/jobs/document-summaries.
The conversation database also stores raw model request bodies, thinking, intermediate and final answers, Tool arguments, and full Tool result text. These records may include document text, paths, queries, summaries, and encoded images. They are persistent local records, not temporary previews, and are excluded from subsequent model history. Deleting a conversation deletes its diagnostic message rows. Secret interactive terminal input must not enter these records.
Bounded operational metadata is written under ~/.privateAI/logs. Current logs omit prompt text, model answer text, local document paths, local document search queries, and local document Tool output. Browser screenshots supplied to the local vision model are retained under ~/.privateAI/logs/browser-frames.
Network features
PrivateAI is local-first, not network-free. Public web, Browser, and Apple service Tools contact the relevant public endpoint or Apple service when invoked. The checked-in App does not implement advertising or product analytics.
Conversations containing document attachments run in document privacy mode. That mode exposes restricted local document Tools and does not expose public Web, Browser, Terminal, or native service Tools.
File access
Files selected through the system picker or Finder are copied into managed storage. An explicitly referenced supported local path authorizes that exact file for the request, not sibling files or the containing directory. Searchable PDFs are read with PDFKit; scanned PDFs without a text layer are not processed with OCR.
Security and retention
The current development target has App Sandbox disabled. Managed artifact and log directories use owner-only permissions. Deleting a conversation removes its attachment references; unreferenced managed blobs are reclaimed by reconciliation. Deleting the App alone does not necessarily remove data under ~/.privateAI.
Changes and contact
Material changes will be reflected by a new effective date. Use the repository's public support channel for privacy questions and GitHub private vulnerability reporting for security issues.
See the version-controlled policy and security policy.