On-device processing: what it actually means
Every app claims your data never leaves your device. Some of them mean it, some mean it except for the interesting parts, and you can usually tell which from things the marketing page does not say.
"Processed on your device." "Your data never leaves your Mac." "Privacy-first." These phrases appear on almost every app page now, including ours, and they are doing a lot of unexamined work.
The claim is meaningful. It is also easy to make in a form that is technically true and practically misleading. Here is how to read it.
What the honest version means
An app that genuinely processes on-device does the work using your machine's own CPU or GPU, reading files from your disk and writing results back to it. If you unplugged the network, it would carry on working exactly the same.
That is the test, and it is a good one: would this feature still work in aeroplane mode? If yes, the processing is local. If it silently degrades or fails, something was going somewhere.
The gaps that hide inside a true statement
"Your files are processed locally" — but telemetry is not a file. An app can genuinely never upload your documents while still reporting which features you used, how often, your device model, your approximate location and a persistent identifier. All of that is "not your data" by a narrow reading and very much your data by any other.
Some features are local, others are not. A photo editor can do every edit on your Mac and still send an image to a server for one AI-powered feature. The page says "edits happen on your device", which is true of most edits.
The platform is not the app. Dictation, speech recognition, translation and Live Text are system services. An app that uses them is subject to the system's behaviour: Apple's speech recognition often runs on-device, but when on-device recognition is not available for a language or a device, macOS may send audio to Apple. The app did not upload anything. Audio still left the machine. An honest app page says this; most do not.
Sync is a network feature by definition. "Local processing, syncs across your devices" means the data is on a server. It may be end-to-end encrypted, which is a genuinely strong protection — but that is a different claim, and it is worth checking which one is being made.
Crash reports contain more than crashes. Depending on implementation, a crash report can include fragments of memory, file paths and document names.
How to check for yourself
You do not have to take anyone's word for it.
Look at the sandbox entitlements. Mac App Store apps are sandboxed, and an app that has no outgoing network entitlement cannot make a network connection — the system will not let it, regardless of what the code tries. This is a hard guarantee rather than a promise, and it is the strongest signal available. You can inspect entitlements with codesign -d --entitlements - /Applications/Something.app in Terminal.
Watch the connections. Little Snitch, LuLu or a similar outbound firewall shows you what an app actually contacts, live. This is the definitive answer and takes a few minutes.
Read the App Store privacy label — then notice that it is self-declared, and that "Data Not Collected" is a much stronger statement than a long list of "not linked to you" categories.
Turn the network off and use the app. Crude, effective.
What we do, stated precisely
Our Mac utilities process your files on your Mac. Specifically:
- RenameDeck is sandboxed with no network entitlement at all — names and metadata are processed locally because the app is structurally incapable of doing otherwise.
- Ziploom does all archive work on your machine, with no accounts, analytics, telemetry or network features.
- Compact Contacts reads the contacts macOS already has. There is no developer-operated contact backend and no app account; synchronisation between your own devices is handled by macOS and your account providers, not by us.
- ClackSmith reads count-only key events and never receives key identities or typed characters.
- Miyu Paint and Garfi do their editing and export on your device.
And the caveats, because a privacy claim without its exceptions is marketing:
- Garfi's automatic captions use Apple's speech recognition. When on-device recognition is unavailable, macOS may send audio to Apple for processing. That is Apple's system service behaving normally, and it is still audio leaving your machine.
- Purchases and restoration are handled by Apple, which necessarily involves Apple.
- This website is not one of our apps. It runs Google Analytics. The apps carry no third-party analytics; the site you are reading does. We would rather write that sentence than leave you to discover it.
None of our apps has an account. There is no advertising anywhere.
That last set of bullet points is the part most pages leave out, and it is the part that tells you whether to believe the rest.