Where the brains come from
Short answer: every brain M1K3 downloads is named in the app's source, pinned to one exact revision of one Hugging Face repository, and checked file by file against a SHA-256 digest that ships inside the app. A file that does not match is refused, not retried. A brain changes only with a new app version, and nothing about your downloads is reported to anyone.
Which brains ship today
Mini is Apple's on-device model where Apple Intelligence runs, so there is nothing to download; on a device without it, a small LFM2.5 brain stands in. Lil and Big download once, when you ask; the other rows are the weights behind semantic memory, the M1K3 Voice and sharper speech recognition. The MLX files are community quantisations of the authors' releases, each under its author's licence as its model card publishes it, which M1K3 does not alter.
| What | Weights | Licence as published |
|---|---|---|
| Mini | Apple Foundation Models — ships with macOS 26 and iOS 26 | Apple's terms; nothing downloaded |
| Mini without Apple Intelligence | mlx-community/LFM2.5-1.2B-Instruct-4bit — about 630 MB | LFM Open License v1.0 (tagged "other", licence name lfm1.0) |
| Lil | mlx-community/Qwen3.5-4B-MLX-4bit — about 3 GB | Apache 2.0 |
| Big | mlx-community/gemma-4-12B-it-4bit — about 6.7 GB | Apache 2.0 — the quantised repository's card names no licence; its base model, google/gemma-4-12B-it, is published under Apache 2.0 |
| Semantic memory | mlx-community/embeddinggemma-2-8bit | Apache 2.0 |
| M1K3 Voice | round-tower/Kokoro-82M-bf16, a bfloat16 conversion of hexgrad/Kokoro-82M, plus one voice-styles file from a GitHub release of thewh1teagle/kokoro-onnx | Apache 2.0 |
| Sharper speech recognition | argmaxinc/whisperkit-coreml — Whisper small.en by default | MIT |
How a download is checked
The app carries a manifest, PinnedWeights.swift, built from a local copy of each model that had been run and evaluated and cross-checked against Hugging Face's published file identifiers: for every repository the full git revision, for every file its size and SHA-256 digest. A download resolves against that revision, never a branch; a request for main is ignored by design, because a branch is the moving target the pin exists to remove.
After the download, every pinned file is hashed and compared. Not arrived yet: a download in progress. Present but wrong: refused. The app does not load it, does not delete it (it is evidence) and does not retry, since fetching again from the same source could hide an attack behind a flaky-looking connection. Settings says: “I didn't use those files: they don't match what this version of M1K3 expects. I left them untouched. Try the download again, and tell us if it keeps happening.” A file that cannot be read is not loaded either; weights left from an earlier release are told apart from tampering and simply fetched again at the pinned revision.
Why the digests live in the app rather than on the server: a hash fetched from the host that serves the file proves nothing, because whoever can swap the file can swap its hash. A digest that travels with the app's source, reviewed like code, changes only when a release changes. The caveat: the first pin came from bytes we had already run and trusted, the trust-on-first-use step every pinning scheme has.
Three gaps today. The M1K3 Voice pins its two Hugging Face files the same way; its voice-styles file from GitHub is not pinned. The WhisperKit speech models are fetched by the WhisperKit library, unpinned, so Settings shows their size as an estimate. Big's chat template (tokenizer metadata, not weights) is replaced before the check with Google's later canonical copy carried in the app, so the pinned digest is of the corrected file.
Where the weights live
On your Mac, inside the app's sandbox container; on iPhone or iPad, inside the app's container there. Only the app reads them; they never leave the device, and nothing about them is uploaded. Settings › Brains & downloads names every download and is where you remove a brain, the speech models or the voice; removing the app and its container removes them all. The downloads go straight to huggingface.co, and the voice-styles file to github.com, as ordinary requests under those sites' privacy policies; none of it passes through Round Tower, which has no servers. Every network crossing is listed on the privacy page.
How brains change
A new brain, or a new revision of one, is a change to the pinned manifest in the app's source: reviewed like any other behaviour change, shipped in a new app version, named in its release notes. The app reads its catalogue from its own binary, never from this site or any server, so a running copy cannot have its model swapped from outside. The measurements behind each pick are on the brains page, generated from the committed eval runs.
That is how it works today: there is no over-the-air model update of any kind. If that ever changes, it will be announced on this page first, before any build that could do it ships.
What we do not do
- No telemetry on downloads. A download sends the request itself, to Hugging Face or GitHub, and nothing else.
- No account, no sign-in, no key. The models are public repositories.
- Nothing uploaded: not the weights, not what you ask them, not which brain you picked.
- No silent swaps. No model changes between app releases, and no download starts without your asking, apart from the small Mini on first run on a device without Apple Intelligence, which the privacy page explains.
Brains you can check.
M1K3 is free for humans, source-available, and on-device by default. The manifest is in the repo; the evals are on the brains page.
