What "private" has to mean for something that reads everything
A tool that indexes your whole disk is asking for a great deal of trust. The only useful way to answer that is specifically, so this page says where every byte goes, including the parts that are less absolute than a marketing line would be.
No filename, file path or file content leaves your Mac, ever. Reading, character recognition, image description and searching all run locally. The app does use the network twice and neither time is about your files: it downloads the models once on first run, and it contacts the licensing server to activate or renew your licence.
The three places a search tool can leak
Most privacy claims are unfalsifiable because they never say what they are about. There are only three places this kind of software can send your data, so it is easier to go through them one at a time.
The index
Everything Loupe knows lives in one SQLite file on your Mac. Nothing is copied to a server, there is no account to create, and there is no sync. Delete that one file and the app forgets everything without a document of yours being touched.
It is not encrypted, and that is worth saying plainly rather than leaving for someone to find out. It is an ordinary file with ordinary permissions, so on a Mac with FileVault on it is encrypted exactly as the rest of your disk is, and on one without, anything that can read your documents can read the index of them. That is the same exposure your documents already have, but the index concentrates it, and on a shared machine that is a real consideration.
The models
The character recognition, the vision model that describes pictures and the encoder that handles meaning all run on your Mac, on the GPU. Their weights are downloaded once, by a helper, the first time you run the app, and never fetched again. Nothing is sent to them across a network because they are not across a network. This is also why Apple silicon and macOS 26 are required rather than preferred.
There is no API key field anywhere in the app, and no setting that would point it at a provider, because there is no code in it that could call one.
Telemetry
There is none. No analytics, no crash reporting, no usage counts, no first-run ping. This website does not have any either, which is a smaller thing but the same argument: it would be strange to claim the app touches no network on a page that phones home.
The one thing it does send
Being straight about this matters more than the sentence it costs. When you activate a licence, the app posts three things to the licensing server: the key you bought, a label naming the Mac so you can tell your machines apart, and a device slot so a renewal does not consume a new one. No filename, no path, no content, no search you have run.
A lifetime licence does that once. A monthly subscription is issued as a short lease of about a month and renewed while the subscription is live, which is the mechanism by which cancelling eventually stops the app working. If you want a copy that contacts nothing after the first day, the lifetime licence is that copy.
It reads, and that is all
The other half of trusting something with your whole disk is what it does once it is in there. Loupe never writes. No file is moved, renamed, tidied or deleted, and there is no code path in the app that could do any of those things.
That was a decision rather than an omission. Filing your downloads for you was half the original idea, it got built, and it was cut: search answers "where did that go" directly, so tidying a folder buys nothing that finding the file does not already give you, and a feature that moves somebody's files has to be a great deal better than usually-right to be worth the trust it spends.
Some things it will not even open. Application package contents, .git directories, node_modules and your ~/Library folder are skipped entirely.
How to check any of this
Do not take the page's word for it. Once the first run has finished downloading the models, turn off the Wi-Fi and use it. Indexing and searching carry on exactly as before, because there is nothing on the other end of a connection for them to wait for. The only thing that will fail is activating a licence, which is the one place this page says a connection is needed.
Questions people ask about this
Does Loupe upload my files?
No. Reading, character recognition, image description and searching all happen on your Mac, and no filename, file path or file content is sent anywhere at any point. There is no account, no sync and no server holding a copy of your index.
So does it use the network at all?
Twice, and neither is your data. The models are downloaded once, by a helper, the first time you run it, and never fetched again. And activating your licence contacts the licensing server, sending the key you bought, a label for the Mac and a device slot. A lifetime licence does that once. A monthly subscription renews a 35-day lease, so it happens roughly monthly, which is how a cancelled subscription eventually stops working.
Can I use it with no internet at all?
After the first run, yes. Searching never needs the network. The two exceptions are the initial model download and licence activation, both of which need a connection at the moment they happen.
Is the index encrypted?
No. It is an ordinary SQLite file in your user folder with ordinary file permissions. If you have FileVault on, it is encrypted the way the rest of your disk is; if you do not, anything that can read the file can read the index. Worth knowing that the index holds text pulled out of your documents, so on a shared or unencrypted Mac it deserves the same care the documents do.
Does it describe my photos without asking?
Image description is on by default, and the onboarding screen shows it already enabled rather than asking you to opt in. It runs entirely on your Mac, so nothing is uploaded either way, but the switch is there and it can be turned off per folder or altogether.
What does it refuse to look at?
Application package contents, .git directories, node_modules and your Library folder are never opened. On a developer machine most files on the disk are repository source, so those are hidden from ordinary results unless you ask for them with the code scope.
Turn the Wi-Fi off and try it.
After the first run there is nothing for it to reach, and searching does not notice. Seven days, no card, no account.
- Apple silicon · macOS 26 or later
- No account
- Nothing leaves your Mac