SagaKnow where your messages go.
Your history holds other people's words too. Here is what Saga keeps on your Mac, and the few times a feature contacts another service.
Saga has no server. There's no account, no analytics and no cloud AI.
We haven't yet published a network capture. Until we do, this page describes what the code does.
What stays on your Mac
- The vault. Append-only compressed message segments, media references and settings such as names, merges and clean-up rules. Compression is not encryption.
- The search index. A local database of message text, contact identifiers and statistics. It is derived from the vault, so it can be rebuilt.
- The backup key. Held in the macOS Keychain. Backup files and any copies you keep are yours to look after.
- Encryption, if you turn it on. Off by default. When on, it seals the vault's message segments and settings with AES-256-GCM under your passphrase and an independent recovery code. The search index and caches stay readable.
What can leave the Mac, and when
| Action | What happens |
|---|---|
| Import, search, statistics, clean-up, merges | All local. A cloud-mounted vault involves your storage provider. |
| Android tools download | Setup fetches Google's platform-tools. Google sees an ordinary download. |
| Update check | Once a day, on launch, one request to api.github.com for Saga's latest release. It carries nothing but the request: no identifier, no archive data, no usage, no query string. The answer is a version number and a link. |
| Summaries and questions | Apple Intelligence on device, or a local Ollama or LM Studio server. |
| Link titles | One request to Spotify, YouTube or SoundCloud with the shared URL. |
| Artwork | A remote thumbnail loads from the host that serves it. |
| Embedded players | Opening a player loads that service's page, which sees your IP address. |
| Cloud, NAS and media folders | Read through the storage provider you chose; an online-only file downloads. |
| MCP client | Saga's server is local and read-only; the client decides where results go. |
| Export, copy and share | Saved files and copied text go only where you send them. |
Previews, players and the update check
Link previews are off by default. Turning one on sends the shared URL to that provider, and cached titles can still show while the toggle is off. Opening a player or an external link contacts its service either way.
The update check is on by default and easy to turn off. It runs at most once every 24 hours, whether or not Saga finds a newer release, and a failed check is not retried until the next day. It stores three things on your Mac: when it last checked, the version it last saw, and any version you dismissed with the × on the Home banner. With Settings → Archive → Updates → Check for updates automatically switched off, Saga makes no request at all — the Check now button beside it goes dead too, so nothing can ask GitHub on your behalf.
Keeping it private
Keep the vault and its caches on storage you trust, and protect the whole Mac: deleting the search index does not delete the vault, and deleting local files is not a secure erase. For a strictly offline session, use a network restriction outside the app.
Exports and Wrapped pages can quote messages and name people. Read one before you share it, and remember an export cannot be restored into WhatsApp.
Vulnerability reporting and the project's threat boundaries are in SECURITY.md.
This page mirrors PRIVACY.md in the source repository. The website itself makes no external requests, sets no cookies and uses no analytics.