Privacy isn't a setting. It's the architecture.
DocGraph is privacy-by-design — a core part of what it is, not a checkbox. Here's what the architecture backs, by default.
- 01
Local-first
Your vault is plain HTML and Markdown files on your machine. DocGraph is a lens over them, not a container for them — open them in any editor, back them up however you like, leave at any time. There is no proprietary format to escape.
- 02
Private by default
Network egress is default-deny and allowlisted. A note cannot silently load a remote tracking pixel, font, or script — and when something does reach the network, it's surfaced to you live.
- 03
No cloud, no account, no telemetry
By default, and no silent cloud ever. There's nothing to sign up for, no analytics beacon, no usage phoning home.
- 04
A capable AI, and still local
Chat runs on this computer — a built-in model, Apple's on-device AI or Ollama — and search embeddings run inside the app, so with a local setup nothing about your notes leaves the machine for the AI to work. Pointing it at a remote model, or handing work to an external CLI agent, are separate opt-ins — and the badge in the corner changes the moment either is active.
- 05
Free to use
The app is free, with no account and nothing to sign up for.
A note on the limits
We say privacy is the default because that's what the architecture enforces. Anything that can send data — such as git sync, a cloud AI model, web search or model downloads — is off until you turn it on. The one exception is the daily update check, which is on by default so security fixes reach you: it fetches one file from GitHub, sends nothing about you or your notes, and can be turned off in Settings → General → Updates. The badge in the title bar shows each connection while it runs.
Where DocGraph can't see. Five things you can turn on work outside its network gate:
- External command-line agents such as Claude Code use their own account and connections. DocGraph checks the question it hands over for secrets and logs that the agent ran, but can't see or block what the agent sends.
- The integration server for AI tools. An agent you connect can read your whole vault, and what it reads may go to that agent's AI provider.
- Remote content for a vault. Pages then load images, fonts, stylesheets, media and frames straight from the web — and remote scripts too, if you have also allowed page scripts.
- One-click local web search. The setup asks Docker to download the SearXNG image from Docker Hub, over Docker's own connection.
- Ollama model downloads. When you ask DocGraph to pull a model, Ollama downloads it from its registry over its own connection.
The full details are in the privacy documentation.
Questions about privacy or your data? Write to contact@docgraph.app. There's no account and no database of users to ask about — but if something on this page doesn't match what the app does, we want to hear it. The formal details are in our privacy policy.
Don't take our word for it.
Every call that goes through DocGraph's network gate lights up the badge in the title bar and lands in the Activity Ledger. Open it and watch for yourself — the quietest app you'll run today.