Does M1K3 ever connect to the internet?

Three documented cases, all user-initiated: (1) downloading model weights from Hugging Face, once, only when you opt into the Lil or Big brain — the default Mini brain is Apple's built-in on-device model, nothing to download; (2) the optional web-search and page-reading agent tools, off by default behind a privacy toggle; (3) updates, via TestFlight or by downloading a new DMG from GitHub — the app has no self-updater. Conversations, documents, voice, and calls never leave the Mac.

Where is M1K3's data stored?

In the app's macOS sandbox container, in a GRDB store encrypted with a key held in your Keychain. Documents enter only when you explicitly open or drop them; call transcription is consent-gated and encrypted at rest; the memory store has a forget primitive so consent stays revocable.

How can I verify M1K3's privacy claims?

M1K3 is open source (Apache-2.0), so the claims are inspectable rather than takeable on faith: read the sandbox entitlements file in the repo (each entitlement carries a signed comment explaining why it exists), print the shipped app's entitlements with codesign, watch it with a network monitor like Little Snitch, or pull the ethernet cable mid-conversation — M1K3 doesn't notice.

// privacy architecture

Is M1K3 really private?

Q: Is M1K3 really private?

Yes — by architecture, not by policy. M1K3 runs the whole AI stack on your Mac: LLM inference (Gemma and Qwen via MLX, plus Apple Foundation Models), speech-to-text (WhisperKit), text-to-speech (Kokoro), embeddings, retrieval, and storage all execute on-device inside one sandboxed app, with the store encrypted under a Keychain-held key. The network is used in exactly three documented cases: a one-time model-weights download from Hugging Face when you opt into a bigger brain, an optional web-search tool that is off by default, and app updates via the channel you installed from. No telemetry, no account, no analytics.

Updated 2026-07-10 · By Round Tower, the makers of M1K3 — this page exists so the answer is checkable, not just claimable

Short answer: yes — by architecture, not by promise. M1K3 runs the whole AI stack on your Mac: LLM inference (Gemma and Qwen via MLX-Swift on Metal, plus Apple Foundation Models), speech-to-text (WhisperKit), text-to-speech (Kokoro), embeddings, retrieval, and storage all execute on-device inside one sandboxed app, with the knowledge store encrypted under a key held in your Keychain. The MCP server binds to 127.0.0.1 and is off by default. The network is used in exactly three documented cases: a one-time model-weights download from Hugging Face when you opt into a bigger brain, an optional web-search tool that is off by default, and updates via the channel you installed from. No telemetry, no account, no analytics. Pull the ethernet cable mid-conversation — M1K3 doesn't notice.

What runs where?

One diagram, no arrows hiding anything. The left column is everything M1K3 does; the right column is the complete list of moments it can touch the network.

On your Mac

one sandboxed app · apple silicon · works offline

Chat & inference Gemma and Qwen on MLX-Swift (Metal), Apple Foundation Models for fast turns — hot-swappable, all local.
Voice in WhisperKit / Apple Speech — streaming speech-to-text, on-device.
Voice out Kokoro neural TTS (ONNX Runtime) — synthesis on-device.
Knowledge & memory Embeddings, the personal knowledge graph, and hybrid RAG over your documents — indexed and searched locally.
Call memory Consent-gated transcription and summaries, encrypted at rest.
Storage App-sandboxed GRDB store, encrypted with a Keychain-held key.
MCP server Loopback only — 127.0.0.1:4242, unreachable from the network, off by default in Settings.

The network

the complete list of crossings · all user-initiated

Model weights, once Downloaded from Hugging Face only when you opt into the Lil or Big brain. The default Mini brain is Apple's built-in model — nothing to download.
Web search & page reading (optional) Agent tools behind a privacy toggle, off by default. Web off means web off.
Updates Via TestFlight or a new DMG from GitHub Releases. The app has no self-updater phoning home.
And that's it. No telemetry, no analytics, no account, no crash reporting. Your prompts, documents, voice, and calls are not on this list — by construction.

every crossing above is documented in the repo

What ever touches the network?

A privacy page earns its keep in the exceptions, so here they are, plainly:

Model downloads (one-time, opt-in). M1K3 starts on Mini — Apple's on-device Foundation Model, instant, nothing to download. If you choose a bigger local brain (Lil or Big) or on-device Whisper speech models, the weights download once from huggingface.co; after that, inference runs fully offline. The app's outbound-network entitlement exists for this — the entitlements file says so in a signed comment.
The web tools (opt-in, off by default). The local agent has web-search and page-reading tools behind a privacy toggle. When the toggle is off, the agent has no web tools at all — it can't quietly decide to search. When you turn it on, your search queries go to the web, as searches do.
Updates (via the channel you chose). There is no Sparkle-style self-updater inside the app. TestFlight builds update through Apple's infrastructure; the DMG updates when you download a new one from GitHub Releases; a source build updates when you pull and rebuild.

One adjacent honesty, not a network call M1K3 makes: if you connect a cloud-hosted MCP client to M1K3's loopback server, whatever that client retrieves becomes part of the client's own context and travels wherever its conversations go. Local server, client's rules — the full caveat is on the MCP page.

How is data stored on the Mac?

Everything lives inside the app's macOS sandbox container. The knowledge and memory stores are GRDB databases encrypted with a key held in your Keychain — one place your knowledge lives, on hardware you own. Documents enter only when you explicitly open or drop them (the sandbox grants read access to user-selected files, nothing broader). Call transcription is consent-gated and encrypted at rest. Memory has a consent primitive going the other way too: forget_memory permanently deletes a fact, so what M1K3 knows stays revocable.

There's no telemetry to store elsewhere. Bug reports are user-initiated: Settings → Report an issue… generates a redacted diagnostic that you read and attach to a GitHub issue by hand — nothing is transmitted automatically.

How can you verify any of this?

M1K3 is open source (Apache-2.0), which turns this page from marketing into a checklist:

Read the entitlements. The sandbox entitlements file ships in the repo with a signed comment on every grant explaining why it exists — outbound network for model downloads, inbound listening pinned to loopback for the MCP server, mic access for on-device recognition. Or print what the shipped app actually carries:

$ codesign -d --entitlements - /Applications/M1K3.app
com.apple.security.app-sandbox            → true
com.apple.security.network.client         → true  # model downloads + opt-in web tools
com.apple.security.network.server         → true  # the 127.0.0.1 MCP server, off by default
com.apple.security.device.audio-input     → true  # mic, for on-device speech recognition

Watch the wire. Run a network monitor (Little Snitch, LuLu) while you chat, ingest documents, and talk to it. After any model download you've opted into, there's nothing to see.
Pull the cable. The bluntest instrument is the best one: disconnect mid-conversation. Inference, voice, and retrieval carry on, because none of them ever needed the network.
Read the source. The repo is public, the app is signed and notarized, and the git history carries MurphySig provenance — human-and-AI collaboration on the record.

Frequently asked questions

Does M1K3 send my conversations to a server?

No. Inference, voice, embeddings, and storage are all on-device. Zero bytes of your conversations, documents, or calls go to any server — there's no server in the product to send them to.

Can M1K3 work fully offline?

Yes. The default Mini brain works with nothing to download; once any bigger brain you've opted into has fetched its weights, everything — chat, voice, document search, call memory — runs without a connection.

Is there telemetry, analytics, or a required account?

None of the three. No account, no subscription, no telemetry. Issue reports are user-initiated, redacted before your eyes, and attached to GitHub by hand.

Isn't the MCP server a network hole?

It binds to 127.0.0.1 — loopback, unreachable from other machines — and it's off by default in Settings. The honest caveat: what a connected client retrieves enters that client's context, so connect clients you trust.

// nothing leaves

Privacy you can check.

M1K3 is free, open source, and entirely on-device. Don't take this page's word for it — take the source's.

Join the TestFlight beta Read the source