The short version
OhmsCounsel does not collect your data. The documents you import and the analysis OhmsCounsel produces never leave your Mac.
No developer-operated analytics, telemetry, account, usage metrics, error beacons, advertising IDs, fingerprinting, or crash reporting. OhmsCounsel does not collect, store, or share your content or derived work.
Everything OhmsCounsel does (importing contracts, checking defined terms, numbering and references, summarizing, extracting key terms, comparing against your playbook, diffing versions, scoring risk, and answering cited questions) runs on your Mac using deterministic local code and, where model inference applies, Apple's MLX framework with locally stored Gemma 4 weights. The native app starts an authenticated helper on 127.0.0.1 for same-device work; it is not a remote service and accepts no external connections. Silo Systems runs no service that receives your documents, and there is no OhmsCounsel account. Two paths can reach the network, and both are off until you turn them on: the optional Bring Your Own Key mode, which sends data only to a provider you choose and pay for directly, and the optional model-catalog check, which downloads a metadata file and sends none of your content anywhere. Both are described below.
What we don't have, and therefore never see
OhmsCounsel has no developer-operated server-side component that receives your work, so we do not receive:
- Your name, email, phone, or address.
- A device identifier, MAC address, or any other hardware fingerprint.
- The contracts and documents you import, their extracted text, or any summaries, extractions, clause flags, playbooks, comparisons, risk scores, or chat transcripts you produce in the app.
- The contents of your Documents, Downloads, Desktop, or any other folder.
- Session timing, feature usage, button clicks, or any other behavioural data.
- Crash reports. OhmsCounsel does not implement a crash-reporting SDK.
A public model host receives ordinary request metadata such as an IP address only during a model download you explicitly initiate, under that host's policy. No document content is included.
Outbound traffic you initiate
Three classes of outbound network traffic can originate from your Mac while OhmsCounsel is installed with its default settings. No user content is ever sent anywhere, and the only optional request to Silo Systems is the model-catalog check described below — which is off by default. The model transfer and external links require your action; App Store update behaviour follows your macOS settings. A fourth class — Bring Your Own Key requests, which do include your documents — exists only if you enable it, and is described below as well:
- Model weight downloads. The first time you choose to install an analysis model in Settings, the app shows its exact size, immutable revision, license, managed storage location, integrity file count, and device fit. Only after you consent does it download the selected Gemma 4 checkpoint from Hugging Face. The revision-pinned transfer is restricted to a reviewed host allowlist and a closed SHA-256 file manifest. It requires no OhmsCounsel account, and your documents are never part of the request. Hugging Face receives ordinary network request metadata under its own privacy policy. Cancel leaves no partial model marked ready; retry resumes verified files.
- Mac App Store updates. When Apple ships an OhmsCounsel update, the Mac App Store delivers it. This traffic is between your Mac and Apple's servers, governed by Apple's privacy policy. OhmsCounsel is not involved.
- Links you click. If you click an external link inside the app (for example, opening this privacy policy), your default browser handles the request. OhmsCounsel is not involved.
Optional “check for new models” (off by default)
OhmsCounsel can offer to tell you when a newer build of an analysis model is available. This check is off by default and never runs until you turn it on. Once enabled, OhmsCounsel periodically downloads a small, cryptographically signed model-catalog file from ohmslaw.net — a site operated by Silo Systems and hosted on Vercel. The catalog is metadata about model builds. Nothing is uploaded: the check is a one-way download.
No contract, document, extracted text, clause, playbook, question, or account identifier is part of the request — there is no account to identify you with. The request exposes only what any HTTPS request to any website unavoidably exposes: your IP address and a user-agent string. OhmsCounsel writes no log of the check. The hosting infrastructure may keep standard web access logs, as any web host does; we do not use them to profile you or link them to anything you do in the app.
Turning the setting off stops the checks. OhmsCounsel verifies the catalog's signature before using it, so a missing, expired, or unverifiable catalog simply leaves OhmsCounsel on the model list it already knows about.
Some models the catalog offers may be marked unvalidated (“experimental”). That label means exactly what it says: the model has not been tested on Silo Systems hardware, and the memory and disk requirements shown for it are estimated, not measured — calculated from the model's published size and format rather than from a real run on a real machine. OhmsCounsel shows you the basis for that estimate before anything is downloaded. An unvalidated model is never chosen for you and never installed automatically: it is never a default at any memory tier, and installing one takes an explicit extra confirmation beyond the normal model-download consent. It may need more memory than estimated, or run poorly, on your Mac.
Optional Bring Your Own Key (off by default)
This is the one path by which your content can leave your Mac, and it stays closed until you open it. If you enable cloud inference in Settings and supply your own API key (Anthropic, OpenAI, Google Gemini, or OpenRouter), the content you process with that feature — your documents and questions — is sent over the internet to the provider you selected, under your own account. What you send is then subject to that provider's privacy policy and data-retention practices, not ours. If you handle client or otherwise privileged material, consider that provider relationship carefully before enabling this.
Turning it on requires an explicit in-app confirmation, OhmsCounsel shows a persistent cloud badge whenever a cloud provider is active, and you can return to on-device processing at any time. None of it is ever sent to Silo Systems. We never see your content or your key, and we run no server, proxy, or relay in this path — traffic goes directly from your Mac to the provider you configured. Your key is stored only in the macOS Keychain on this Mac, never in a file, a database, or a log. You can also point OhmsCounsel at Ollama running on your own machine, in which case nothing leaves your network at all.
On-device data you create
The documents you import, extracted text and page maps, local search data, analyses, decisions, chat, playbooks, model weights, and preferences live on your disk under ~/Library/Containers/com.silosystems.ohmscounsel/Data/Library/Application Support/ (plus any files you explicitly choose to export). They are yours. We do not have access to them. OhmsCounsel creates or uploads no backup; macOS and any backup software you configure govern local copies. Settings can remove a managed model, and Import can purge every document-scoped artifact after an explicit confirmation. A separately saved export remains in the folder you chose and is never deleted by the app.
Not legal advice
OhmsCounsel provides informational document analysis only. It is not legal advice and does not create an attorney-client relationship. Always consult a qualified attorney for legal decisions. This product note is not part of the data policy, but we keep it on every surface that shows analysis.
Children's privacy
OhmsCounsel is rated 4+ on the Mac App Store. OhmsCounsel does not knowingly collect personal data from children or anyone else. The same zero-collection policy applies regardless of age.
Third-party services
OhmsCounsel uses these open-source components, one public model host, and one Silo Systems-operated host. Local components receive no data about you. The hosted ones receive ordinary network request metadata only for a request you explicitly approve; no document content is sent:
- Gemma (open-weights language model): runs locally.
- MLX (Apple's array framework): runs locally.
- rank-bm25 / rapidfuzz (passage retrieval and matching): run locally.
- Hugging Face: contacted only when you explicitly approve a revision-pinned model checkpoint download. No document content is sent.
- ohmslaw.net (Silo Systems, hosted on Vercel): contacted only if you turn on the optional model-catalog check, and only to download that signed metadata file. No document content is sent.
Changes
If we ever materially change how OhmsCounsel handles data (for example, if a future version begins to collect anything at all) we will publish an updated version of this page, announce the change prominently in the release notes, and require explicit consent in-app before any new collection begins. The effective date at the top of this document reflects the current policy.
The current policy is: your documents never leave your Mac, and nothing about you is collected.
Contact
Questions about this policy: admin@ohmslaw.net
For non-private inquiries you can also open an issue at github.com/flowmar47/OhmsCounsel.