Is M1K3 really private?

What runs where?

One diagram, no arrows hiding anything. The left column is everything M1K3 does; the right column is the complete list of moments it can touch the network.

What ever touches the network?

A privacy page earns its keep in the exceptions, so here they are, plainly:

1. Model downloads (one-time, when you ask). M1K3 starts on Mini — with Apple Intelligence that is Apple's on-device Foundation Model, instant, nothing to download; on a Mac without it, a small Mini brain (about 630 MB) downloads on first run instead. Beyond that, the Lil or Big brain, semantic memory (the embedder), on-device Whisper speech models and the M1K3 Voice each download once from Hugging Face (huggingface.co); the voice also fetches one voice-styles file from github.com. After that, inference and voice run fully offline. The app's outbound-network entitlement exists for these downloads and the web tools below — the entitlements file says so in a signed comment.
2. The web tools (on by default, one switch to turn them off). The local agent has web-search and page-reading tools so answers can be current. One toggle in Settings ▸ Privacy turns them off; when it is off, the agent has no web tools at all — it can't quietly decide to search. When it is on, your search queries go to the web, as searches do.
3. Updates (via the channel you chose). There is no Sparkle-style self-updater inside the app. Mac App Store builds — and TestFlight builds, for the betas — update through Apple's infrastructure; the DMG updates when you download a new one from GitHub Releases; a source build updates when you pull and rebuild.
4. Private Cloud Compute (opt-in, off by default). Turn it on in Settings and Private Cloud Compute joins the brain picker. Pick it and, the first time, a consent sheet shows exactly what's about to go — the message, plus the conversation so far only if you tick that too — before your typed messages go to Apple's Private Cloud Compute; it stays picked until you choose a brain on this Mac. Never your memories, documents, tools, calendar, location, or profile. Every PCC answer is labelled in the chat; if PCC fails or the quota runs out, the on-device brain answers and says why. Detail below.

One adjacent honesty, not a network call M1K3 makes: if you connect a cloud-hosted MCP client to M1K3's loopback server, whatever that client retrieves becomes part of the client's own context and travels wherever its conversations go. Local server, client's rules — the full caveat is on the MCP page.

What Apple guarantees about Private Cloud Compute

This is Apple's claim, not ours — read it yourself:

“PCC uses that data only to perform the operations requested by the user” and “no user data is retained in any form after the response is returned.”
— Apple, Private Cloud Compute

M1K3 itself has no servers and never sees or stores your conversations, whether they stay on your Mac or make the trip to PCC. With the switch off — the default — none of this applies.

How is data stored on the Mac?

Everything lives inside the app's macOS sandbox container. The knowledge and memory stores are GRDB databases encrypted with a key held in your Keychain — one place your knowledge lives, on hardware you own. Documents enter only when you explicitly open or drop them (the sandbox grants read access to user-selected files, nothing broader). Call transcription is consent-gated and encrypted at rest. Memory has a consent primitive going the other way too: forget_memory permanently deletes a fact, so what M1K3 knows stays revocable.

There's no telemetry to store elsewhere. Bug reports are user-initiated: Settings → Report an issue… generates a redacted diagnostic that you read and attach to a GitHub issue by hand — nothing is transmitted automatically. Likewise, a thumbs-down on an answer can offer Send this exchange to Round Tower…: a sheet shows that one exchange — your message (an attached file's text is left out), M1K3's answer, the brain and the app version, nothing else — which you can edit, and your own mail app sends it to hello@round-tower.ie. Nothing goes without you pressing Send, and M1K3 itself makes no connection. We read it to fix what went wrong, may rewrite it as a made-up test case, and delete it if you ask. And if M1K3 didn't close cleanly last time (a crash, a force-quit, or the Mac or phone ending it), it offers once to send a short report the same way: when that session began, the brain, the app and system versions, any crash summaries your device kept, and anything you add. Nothing you typed or said goes with it. Neither is offered where the declared age is under 16.

Which macOS permissions does M1K3 ask for, and why?

Each one is off until you use the feature that needs it, and each one serves only that feature. None of this data leaves your Mac.

• Call recording (System Audio Recording, and Microphone). Calls are recorded only when you start a recording yourself and affirm that you have consent to record (M1K3 asks every time unless you choose to remember that answer; the decision is timestamped). M1K3 captures two audio channels: your microphone, and the audio your Mac plays (the other side of the call), so the transcript can tell the speakers apart. It captures audio only: M1K3 never captures, records, or stores what is on your screen. The audio is used for one purpose, to transcribe and summarise that call on your Mac with WhisperKit and the on-device brain. It is never sent to Round Tower, Apple, or any third party. The recording is written to the app's sandbox container, kept only until it has been transcribed, and then deleted; the transcript and summary are stored encrypted at rest, and you can delete any call from the Calls list. If you decline the permission, M1K3 records your microphone only. Earlier builds reached the same system audio through macOS's Screen Recording permission, because that was how the capture API delivered it; they read the audio track and discarded every screen frame unread (a 2×2-pixel minimum), never storing an image. Current builds ask only for System Audio Recording.
• Calendar and Location (optional context). Off by default. Switch one on in Settings → Privacy → Context and macOS asks for its permission right then. Calendar reads the titles and times of your next few events; Location reads a coarse ~10 km area unless you choose Precise. Both are read only when a question needs them, used only to ground that answer, never stored, never remembered, never shared, and never mixed with web search in the same turn. Switch it off, or refuse the macOS prompt, and M1K3 stops reading it.
• Microphone and Speech Recognition. Used for voice input. Transcribed on your Mac and never sent anywhere.
• Local Network. Used only by Brain at Home (off by default) to serve M1K3's brain to devices you pair on your own network, encrypted.

How can you verify any of this?

M1K3's source is public — source-available under the Functional Source License (FSL-1.1-ALv2) — which turns this page from marketing into a checklist:

• Read the entitlements. The sandbox entitlements file ships in the repo with a signed comment on every grant explaining why it exists — outbound network for model downloads and the web tools, inbound listening pinned to loopback for the MCP server, mic access for on-device recognition, and Private Cloud Compute gated behind its own developer entitlement. Or print what the shipped app actually carries:

$ codesign -d --entitlements - /Applications/M1K3.app
com.apple.security.app-sandbox            → true
com.apple.security.network.client         → true  # model downloads + the web tools (on by default)
com.apple.security.network.server         → true  # the 127.0.0.1 MCP server, off by default
com.apple.security.device.audio-input     → true  # mic, for on-device speech recognition
com.apple.developer.private-cloud-compute → true  # the opt-in PCC brain, off by default

• Watch the wire. Run a network monitor (Little Snitch, LuLu) while you chat, ingest documents, and talk to it. Apart from the downloads you asked for, the web tools, and updates, there's nothing to see.
• Pull the cable. The bluntest instrument is the best one: disconnect mid-conversation. Inference, voice, and retrieval carry on, because none of them ever needed the network.
• Read the source. The repo is public, the app is signed and notarized, and the git history carries MurphySig provenance — human-and-AI collaboration on the record.

Frequently asked questions

Privacy policy

Everything above is the architecture. This section is the policy, in the form a directory, a reviewer or a regulator expects, and it says the same thing in fewer words. Effective 2026-10-18.

• Who is responsible. Round Tower Software Ltd, a company registered in Ireland (“Round Tower”), makes M1K3 and runs this website. Contact: hello@round-tower.ie.
• What the app collects about you: nothing. M1K3 has no account, no sign-in, no telemetry, no analytics, no automatic crash reporting and no advertising. Round Tower receives nothing from the app itself and keeps no record of who uses it; the only things we can ever receive are an exchange you choose to email us from a thumbs-down, or a short report you choose to send after M1K3 didn't close cleanly, each through your own mail app after seeing the exact text. Your conversations, documents, memories, call transcripts and settings are stored only on your device, inside the app's sandbox container; the knowledge and memory stores and call transcripts are encrypted with a key held in your Keychain. The four network crossings listed above go to those third parties under their own privacy policies, and none of them goes through Round Tower: model downloads (the ones you ask for, and the Mini fallback on first run on a Mac without Apple Intelligence) from Hugging Face and GitHub; web tools, on by default with one switch to turn them off, which send the query M1K3 writes to DuckDuckGo and fetch Wikipedia summaries and the pages you ask it to read directly from those sites; updates through the channel you installed from; and, only if you turn it on and pick it as your brain, what you send to Apple's Private Cloud Compute.
• Apple. If you installed M1K3 from the App Store, Apple handles the download, any update and any opt-in crash and usage sharing you have enabled in your Apple account, under Apple's privacy policy.
• This website. m1k3.app sets no cookies and runs no analytics. Fonts, scripts and the 3D fox are served from this domain, with one exception: the experimental /vr demo loads the three.js library from the jsDelivr CDN, so your browser sends that CDN an ordinary request for the file. The site is hosted on Netlify, acting as Round Tower's processor, whose servers may keep ordinary short-lived access logs (IP address, requested page, browser string) for security and operation under Netlify's privacy policy; Round Tower is the controller for those logs, keeps the host's analytics off, and does not export them or combine them with anything.
• Email. If you write to us, we keep your message and address to deal with it (our legitimate interest in answering you) and delete the thread within twelve months of the last reply, unless it concerns a security report or a contract, which we keep for as long as that matter needs. We use them only to reply or, for an exchange or a snag report you send from the app, to fix what went wrong, and we do not add you to any list.
• Your rights. Under the GDPR and equivalent laws you can ask what personal data we hold about you, have it corrected or deleted, object to its processing and complain to a supervisory authority; in Ireland that is the Data Protection Commission. Because the app sends us nothing, a request will usually find nothing on our side beyond any email you sent us. Data inside the app is yours to delete directly: forget a memory from within M1K3, or remove the app and its container.
• Children. M1K3 is a general-purpose tool and is not directed at children. We knowingly collect no personal data from anyone, children included; a parent or guardian who believes a child has sent us data by email can ask us to delete it.
• Changes. When this page changes, the date at the top changes with it, and the page's git history is the public record of every edit. The Terms of Service are a separate page.