Why our Mac apps keep your files on your Mac
Most software asks for a small leap of faith. You open a document, and somewhere between "open" and "done" your file may have been sent off to be processed, indexed, or synced — usually for good reasons, occasionally for reasons in a privacy policy you didn't read. For a holiday photo, fine. For a contract, a medical form, a company spreadsheet, that quiet round trip is exactly the part you'd want to know about.
The TruePath apps are built the other way around. They do their work entirely on your Mac. No cloud, no account, your files never leave it — and they keep working with the Wi-Fi off. This is a note on what that actually means, and, more usefully, how you can check it instead of trusting us.
What "runs on your Mac" means here
It's easy to say and easy to fudge, so here's the specific version. There's no sign-up, because there's no server keeping an account for you. Your files aren't uploaded, because the app does its work locally — reading a PDF, evaluating a spreadsheet, rendering a frame all happen on your own processor. What does leave your Mac is small, and never your files. The apps send anonymous diagnostics (crash reports and a count of which formats or features get used), which you can switch off in each app. If you downloaded an app from our website rather than the App Store, it also checks its license and looks for updates. And because none of the core work depends on a network, the apps run the same on a plane as they do at your desk.
Why you shouldn't take that on faith
"We respect your privacy" is the most over-used sentence in software, and you can't audit a sentence. So here are two things you can check without taking our word for anything.
The first needs no code. Turn the Wi-Fi off and carry on working. Nothing the apps do with your files needs a network, so nothing you were doing stops.
The second is code. The MCP server that lets AI agents work on your PDFs is open source under the MIT license. It's a separate program from the TruePath PDF app, built on pdf.js and pdf-lib rather than the app's own engine, so reading it tells you what the server does and not what the app does. It is the piece that hands your documents to an AI, though, and that's where we'd look first too. Read every line, or run it and check that the server itself opens no connections.
The PDF server speaks MCP, so tools like Claude or Cursor can work on your PDFs without the server uploading them. What the server returns does go to whichever model your AI client uses, so pick a local model if the contents must stay on your Mac. We wrote about how that works — the server makes no network calls, which is why the server itself is safe to hand your files to.
Cautious by default
Handing any app more power should be a decision you make, not a default you discover. TruePath Recorder is the clearest example: its AI control is off until you switch it on, you opt in per agent, and when it is on, the local bridge listens on 127.0.0.1 only, behind a token that's regenerated every launch. Nothing off your machine can reach it, and it can only do what the app's own buttons do. The pattern across the apps is the same — the private, local behaviour is the default, and anything with more reach is something you turn on deliberately.
The short version
Keeping your work on-device is a constraint we chose, not a feature we bolted on. It rules out some conveniences — there's no magic cross-device sync waiting in the cloud — and we think that's the right trade when the thing being kept private is your own work. If you'd rather verify than trust, switch the Wi-Fi off and see what still works, and read what each privacy policy says the diagnostics contain. For the PDF server, the source is right there too.
A couple of questions people ask
Do my files get uploaded?
No. The apps run locally — no cloud, no account — and work offline. They send anonymous diagnostics, which you can switch off, and the versions downloaded from our website also check their license and look for updates. Never your files.
How can I verify it?
Turn the Wi-Fi off and keep working, and read each app's privacy policy for what the diagnostics contain. Our PDF server for AI agents is open source (MIT), so you can read its code too. The AI features are off by default and opt-in.