Is M1K3 really private?
Short answer: yes — by architecture, not by promise. M1K3 runs the whole AI stack on your Mac by default: LLM inference (Gemma and Qwen via MLX-Swift on Metal, plus Apple Foundation Models), speech-to-text (WhisperKit), text-to-speech (Kokoro), embeddings, retrieval, and storage all execute on-device inside one sandboxed app, with the knowledge store encrypted under a key held in your Keychain. The MCP server binds to 127.0.0.1 and is off by default. The network is used in exactly four documented cases: a one-time model-weights download from Hugging Face when you opt into a bigger brain, an optional web-search tool that is off by default, updates via the channel you installed from, and — only if you turn it on in Settings — sending one message at a time to Apple's Private Cloud Compute. No telemetry, no account, no analytics. With Private Cloud Compute off, the default, pull the ethernet cable mid-conversation and M1K3 doesn't notice.
What runs where?
One diagram, no arrows hiding anything. The left column is everything M1K3 does; the right column is the complete list of moments it can touch the network.
On your Mac
one sandboxed app · apple silicon · works offline
- Chat & inference Gemma and Qwen on MLX-Swift (Metal), Apple Foundation Models for fast turns — hot-swappable, all local.
- Voice in WhisperKit / Apple Speech — streaming speech-to-text, on-device.
- Voice out Kokoro neural TTS (ONNX Runtime) — synthesis on-device.
- Knowledge & memory Embeddings, the personal knowledge graph, and hybrid RAG over your documents — indexed and searched locally.
- Call memory Consent-gated transcription and summaries, encrypted at rest.
- Storage App-sandboxed GRDB store, encrypted with a Keychain-held key.
- MCP server Loopback only —
127.0.0.1:4242, unreachable from the network, off by default in Settings.
The network
the complete list of crossings · all user-initiated
- Model weights, once Downloaded from Hugging Face only when you opt into the Lil or Big brain. The default Mini brain is Apple's built-in model — nothing to download.
- Web search & page reading (optional) Agent tools behind a privacy toggle, off by default. Web off means web off.
- Updates Via TestFlight or a new DMG from GitHub Releases. The app has no self-updater phoning home.
- Private Cloud Compute (optional, off by default) A cloud button next to the message field, visible only once you turn it on in Settings. Sends one message at a time to Apple's Private Cloud Compute, after a consent sheet; every PCC answer is labelled.
- And that's it. No telemetry, no analytics, no account, no crash reporting. With Private Cloud Compute off — the default — your prompts, documents, voice, and calls are not on this list, by construction. Turn it on and only the one message you send (plus the conversation so far, if you tick it) ever crosses — never memories, documents, tools, calendar, location, or your profile.
every crossing above is documented in the repo
What ever touches the network?
A privacy page earns its keep in the exceptions, so here they are, plainly:
- Model downloads (one-time, opt-in). M1K3 starts on Mini — Apple's on-device Foundation Model, instant, nothing to download. If you choose a bigger local brain (Lil or Big) or on-device Whisper speech models, the weights download once from
huggingface.co; after that, inference runs fully offline. The app's outbound-network entitlement exists for this — the entitlements file says so in a signed comment. - The web tools (opt-in, off by default). The local agent has web-search and page-reading tools behind a privacy toggle. When the toggle is off, the agent has no web tools at all — it can't quietly decide to search. When you turn it on, your search queries go to the web, as searches do.
- Updates (via the channel you chose). There is no Sparkle-style self-updater inside the app. TestFlight builds update through Apple's infrastructure; the DMG updates when you download a new one from GitHub Releases; a source build updates when you pull and rebuild.
- Private Cloud Compute (opt-in, off by default). Turn it on in Settings and a cloud button appears next to the message field. Tap it and a consent sheet shows exactly what's about to go — the message, plus the conversation so far only if you tick that too — before it sends one message at a time to Apple's Private Cloud Compute. Never your memories, documents, tools, calendar, location, or profile. Every PCC answer is labelled in the chat; if PCC fails or the quota runs out, the on-device brain answers and says why. Detail below.
One adjacent honesty, not a network call M1K3 makes: if you connect a cloud-hosted MCP client to M1K3's loopback server, whatever that client retrieves becomes part of the client's own context and travels wherever its conversations go. Local server, client's rules — the full caveat is on the MCP page.
What Apple guarantees about Private Cloud Compute
This is Apple's claim, not ours — read it yourself:
“PCC uses that data only to perform the operations requested by the user” and “no user data is retained in any form after the response is returned.”
— Apple, Private Cloud Compute
M1K3 itself has no servers and never sees or stores your conversations, whether they stay on your Mac or make the one-time trip to PCC. With the switch off — the default — none of this applies.
How is data stored on the Mac?
Everything lives inside the app's macOS sandbox container. The knowledge and memory stores are GRDB databases encrypted with a key held in your Keychain — one place your knowledge lives, on hardware you own. Documents enter only when you explicitly open or drop them (the sandbox grants read access to user-selected files, nothing broader). Call transcription is consent-gated and encrypted at rest. Memory has a consent primitive going the other way too: forget_memory permanently deletes a fact, so what M1K3 knows stays revocable.
There's no telemetry to store elsewhere. Bug reports are user-initiated: Settings → Report an issue… generates a redacted diagnostic that you read and attach to a GitHub issue by hand — nothing is transmitted automatically.
How can you verify any of this?
M1K3's source is public — source-available under the Functional Source License (FSL-1.1-ALv2) — which turns this page from marketing into a checklist:
- Read the entitlements. The sandbox entitlements file ships in the repo with a signed comment on every grant explaining why it exists — outbound network for model downloads, inbound listening pinned to loopback for the MCP server, mic access for on-device recognition, and Private Cloud Compute gated behind its own developer entitlement. Or print what the shipped app actually carries:
$ codesign -d --entitlements - /Applications/M1K3.app com.apple.security.app-sandbox → true com.apple.security.network.client → true # model downloads + opt-in web tools com.apple.security.network.server → true # the 127.0.0.1 MCP server, off by default com.apple.security.device.audio-input → true # mic, for on-device speech recognition com.apple.developer.private-cloud-compute → true # the opt-in cloud button, off by default
- Watch the wire. Run a network monitor (Little Snitch, LuLu) while you chat, ingest documents, and talk to it. After any model download you've opted into, there's nothing to see.
- Pull the cable. The bluntest instrument is the best one: disconnect mid-conversation. Inference, voice, and retrieval carry on, because none of them ever needed the network.
- Read the source. The repo is public, the app is signed and notarized, and the git history carries MurphySig provenance — human-and-AI collaboration on the record.
Frequently asked questions
Does M1K3 send my conversations to a server?
Not by default, and never to a server M1K3 runs — it doesn't have one. Inference, voice, embeddings, and storage are all on-device. If you turn on Private Cloud Compute in Settings, the one message you choose to send — and only that message — goes to Apple's Private Cloud Compute; your documents, memories, and calls are never included.
Can M1K3 work fully offline?
Yes. The default Mini brain works with nothing to download; once any bigger brain you've opted into has fetched its weights, everything — chat, voice, document search, call memory — runs without a connection.
Is there telemetry, analytics, or a required account?
None of the three. No account, no subscription, no telemetry. Issue reports are user-initiated, redacted before your eyes, and attached to GitHub by hand.
Isn't the MCP server a network hole?
It binds to 127.0.0.1 — loopback, unreachable from other machines — and it's off by default in Settings. The honest caveat: what a connected client retrieves enters that client's context, so connect clients you trust.
What happens if I turn on Private Cloud Compute?
A cloud button appears next to the message field. Tap it and M1K3 shows you exactly what's about to leave — the message, plus the conversation so far only if you tick it, never your memories, documents, tools, calendar, or location — before it sends to Apple's Private Cloud Compute. Apple's own guarantee: “no user data is retained in any form after the response is returned.” Every PCC answer is labelled; leave the switch off and none of this applies.
Privacy you can check.
M1K3 is free for humans, source-available, and on-device by default. Don't take this page's word for it — take the source's.