Skip to content
MetalMind

Privacy Policy

The application collects nothing about you: no accounts, no analytics, no crash reporting, no server of its own. This website is a separate matter — it can use Google Analytics to count visits, and only if you allow it.

Last updated 2026-10-24

The application and this website are different things

Everything below about zero data collection describes the MetalMind application running on your Mac. That claim is unconditional and is not affected by anything on this page about the website.

This website is an ordinary marketing site and it does use Google Analytics 4 to count visits. Saying otherwise would be the exact kind of omission the application exists to avoid.

Analytics on this website

Analytics is denied by default. Before any measurement library loads, the site sets Google Consent Mode v2 with every storage type — analytics, advertising, personalisation — set to denied. Nothing is written to your browser and no analytics cookie is set until you press Allow in the banner.

If you allow it, Google Analytics 4 records the usual page-level data:

  • Which pages you opened, and when.
  • Referrer, approximate location derived from your IP address, device type, browser, and language.
  • A random identifier stored in a cookie so repeat visits are counted as one visitor.

Google Analytics 4 does not log or store your IP address, and advertising features are switched off. The data goes to Google as a processor and is governed by Google's privacy terms.

If you reject, the library still loads but runs in cookieless mode: no identifier, no cookie, nothing stored on your device. Your answer is remembered in your browser's local storage under metalmind.consent — that entry never leaves your device — and you can change it at any time through the Analytics settings link in the footer.

No other third party is contacted: no advertising network, no embedded fonts, no social widgets, no session recording, no A/B testing service. The site's Content-Security-Policy blocks anything else at the browser level.

What stays on your device

Everything the application produces is written inside its sandboxed Application Support directory on your Mac:

  • Conversations and their measured metrics.
  • Downloaded model weights.
  • Application settings, including the server port and auto-sleep interval.
  • The local history of API requests shown in the request inspector.
  • Benchmark results — the best recorded run for each model.

None of it is transmitted anywhere. The developer has no access to it, no mechanism to request it, and no copy of it. Deleting the application removes it; you can also delete the files yourself.

Files, calendar, and shortcuts

The model can work with things on your Mac. All of it happens on the device, and none of it happens quietly:

  • Files and folders. Read when you drag them into the composer, and only those. There is no background indexing, no crawling of directories you did not open, and no retained access once the conversation moves on.
  • File changes. A proposed edit is rendered as a side-by-side diff and written only when you click to apply it. The application has no mode in which it writes to disk on its own.
  • Calendar and reminders. Accessed through Apple's EventKit, which asks for your permission the first time and can be revoked in System Settings → Privacy & Security. Events and reminders the model suggests are staged for your approval, never created silently.
  • Shortcuts. The model can launch shortcuts you already have, and the Transform Text and Run Prompt App Intents let Shortcuts call the model. A shortcut runs only when you approve that run.

The contents of your files, your calendar, and the output of your shortcuts are processed by the model on your GPU and are not transmitted anywhere. They are not sent to the developer, and the local API server cannot reach them — it serves text completions and nothing else.

Training your own models

Since version 1.3 you can fine-tune a model on your own examples. That material is often the most sensitive thing anyone puts into the application — sent emails, support transcripts, contracts, internal documents — so it is worth being exact about where it goes:

  • The examples. What you type, the files you import, the documents you point it at, and the conversations you reuse are read on your Mac and stored in the application's own sandboxed directory. They are not uploaded, and no part of them is transmitted to the developer or anyone else.
  • The generated practice material. The additional examples MetalMind writes are produced by the model you selected, running locally on your GPU. No external service generates them.
  • The training run. LoRA fine-tuning runs on the GPU of your Mac through Apple MLX. There is no remote training, no queue on someone else's hardware, and no step that requires a network connection once the base model is on disk.
  • The resulting model. An adapter of a few dozen megabytes, stored in Application Support alongside its earlier versions. Delete the model in the application, or delete the files, and it is gone. Exporting it writes a copy wherever you choose.

Nothing you train is used to improve MetalMind, because nothing you train is ever seen by it. The base model you start from is downloaded from Hugging Face in the ordinary way described below; after that, training is an offline operation.

Dictation, read-aloud, and transcription

Dictation and the transcription of recordings you attach both run through a speech model on your Mac, and so does reading a reply aloud. Microphone access is requested by macOS the first time and can be revoked in System Settings → Privacy & Security. Listening starts and stops when you click: there is no always-on mode and no wake word. A dictated recording exists in memory only until it has been transcribed and is never written to disk. No audio, and no transcript, is sent anywhere.

Documents you attach

PDF, Word, RTF and OpenDocument files are read with PDFKit and the rich-text importers that ship with macOS, in the application's own process. No document parsing service is involved and no part of a document is uploaded. The extracted text is handed to the model on your GPU like any other part of the conversation.

Outbound connections the application makes

MetalMind contacts Hugging Face in two situations: when you search the model hub from inside the application, and when you download the weights of a model you chose.

Be aware of what that means: those requests reach Hugging Face from your network, so your IP address and the usual request metadata are visible to them, as with any website you open. Their handling of that data is governed by their own privacy policy, not by this one. If you never search for or download a model, MetalMind makes no outbound connection at all.

Beyond this, the application contains no analytics SDK, no telemetry endpoint, no crash-reporting library, and no advertising identifier. The analytics described above run in this website in your browser, never in the application.

The local API server

The OpenAI-compatible server binds to the loopback interface 127.0.0.1 only, on port 8080 by default. It is not published on your network interface, so other devices on your network cannot reach it. Requests and responses that pass through it are processed on your Mac and do not leave it.

Apple Intelligence

If you select the system model, generation is handled by Apple Intelligence on your device and is governed by Apple's rules and privacy terms rather than by MetalMind. See Apple's Privacy Policy for how Apple handles that processing. The system model is not exposed through the local API server.

Diagnostic report

MetalMind can assemble a diagnostic report to help with a support request. It is built at the moment you open Settings → System → Support, it is shown to you in full before anything happens, and it is sent only if you press Email yourself. Nothing is transmitted in the background.

The report contains:

  • Application version.
  • macOS version.
  • Chip and number of GPU cores.
  • Memory size.
  • The selected model and its current state.
  • Your plan (Free or Pro).
  • Server state, the number of requests served, and the last error.

It contains no conversation content, no prompts, and no model output.

Purchases

Pro is sold through the App Store. Apple processes the payment; the developer never sees your payment details, name, or address. What the application can check is whether a valid licence exists for the Apple ID in use.

Children

MetalMind is not directed at children and collects no data from anyone, children included.

Changes to this policy

If this policy changes, the updated version will be published on this page with a new date. Material changes to how data is handled will be noted in the application release notes.

Who publishes MetalMind

Since the application collects no personal data, there is nothing to request access to, correct, or erase — but if you have a question about any of the above, write to the address here and you will get an answer from a person.