Local is not automatically private

The claim people make, and the claim that is true

“It runs locally, so nothing leaves the machine.” That is a claim about one component in a system that has several. The model weights running under your own process do not phone anyone. Everything around them might.

If privacy is the reason you are doing this, and for many people it is the only reason, then the guarantee has to be checked rather than assumed, because it is the sort of guarantee that fails quietly.

Where the leaks actually are

The application, not the model. A desktop chat application that runs a local model may still send crash reports, usage analytics, prompt text for a “cloud sync” feature, or embeddings to a hosted vector service. Several popular local-first tools have shipped analytics on by default at some point. The model being local says nothing about the app being local.

Hybrid features. Web search, document upload with cloud parsing, a “use a bigger model for hard questions” toggle, or an image feature backed by an API. Each is a documented feature and each one sends your text somewhere. The dangerous ones are the automatic ones.

Model downloads. Fetching a model tells the host which model you fetched, from which address, when. Harmless in most contexts, not in all.

Extensions and integrations. An editor plugin that routes to your local server may still send telemetry about what you typed, and a browser extension has the page contents by definition.

Your own logs. A server that logs full prompts to disk has created a plain-text archive of the most sensitive material you own, usually in a directory with default permissions, usually included in whatever backs your home folder up. This is the most common real leak and it is entirely self-inflicted.

The checks worth doing once

Watch the traffic rather than reading the marketing:

# macOS / Linux: what is this process talking to?
sudo lsof -i -P | grep -i ollama

# a live view of connections from a given binary
sudo tcpdump -n -i any 'not net 127.0.0.0/8 and not net 10.0.0.0/8'

Run a real session and watch. If a local tool opens a connection you did not expect, find out what it is before continuing. The strong version of this test is to block the process at the firewall entirely and confirm the model still answers; anything that breaks was reaching out for something.

Then check the three configuration items that matter:

• Analytics or telemetry setting in every tool in the chain, including the editor plugin.
• Whether prompt logging is on, and where the file goes.
• Whether the server is bound to 127.0.0.1 rather than 0.0.0.0.

Privacy from the network is not privacy from the disk

Even with no traffic at all, the sensitive text is on your machine in several places: the log file, the shell history if you used curl, the application’s conversation database, the swap file, and any backup. On a laptop that travels, disk encryption is the control that makes the rest of it meaningful: FileVault, LUKS, BitLocker. Without it, “the data never left my machine” is true and irrelevant if the machine leaves you.

Retention is the other half. Decide how long conversations are kept and actually delete them. A local assistant that keeps everything forever has built a richer profile of you than most services you worried about.

What local gives you

Having named the gaps, the guarantee is still real and it is unusual:

• No third-party processing agreement to negotiate, and no sub-processor list to audit.
• No question about whether inputs are used for training.
• No provider-side retention window you do not control.
• No cross-border transfer, which for some regulated work is the entire point.
• No dependency on a vendor’s continued existence or continued policy.

For clinical notes, legal discovery, unpublished research, an employer’s source code, or other people’s private messages, that combination is not a preference. It is often the condition under which the work is permitted at all.

Two things people get wrong in the other direction

Running a model locally does not make you exempt from data protection law. If you process other people’s personal data, the obligations attach to you as the controller (lawful basis, retention, subject access, security) and running the processing on your own hardware makes you responsible for all of it rather than none of it. Being local removes a processor from the chain; it does not remove the duties.

And it does not sanitise the input. If you paste a client’s data into a local model to summarise it, you have still processed the client’s data, and whatever contract governs that processing still applies.