Is your AI app uploading your data? How to find out

Updated 6 September 2026 · 11 min read · By the Vocemo team

Turn off Wi-Fi and use the feature. If it still works, the processing is local. That one test settles most cases in under a minute. Confirm it by watching CPU load and the Sent Bytes column in Activity Monitor, checking the installed size, and leaving an outbound connection monitor running for a few days.

The one minute test

Turn Wi-Fi off, use the feature, see if it still works

Free tools already on your Mac

Activity Monitor Network tab, nettop, lsof

What macOS will not do

Its built-in firewall filters incoming connections only

The label gap

Apple counts data as collected only if kept past the live request

How do I know if an app is sending my data to a server?

You cannot read the contents of an encrypted connection, and you should not try. What you can do is answer three simpler questions that together settle it in practice. Can the feature run with no network at all? Does your Mac's processor do work while the feature runs? Do bytes leave the machine in an amount that scales with the size of what you fed it?

An app that processes locally answers yes, yes, no. An app that calls a server answers no, no, yes. Every test below is a way of asking one of those three questions more precisely.

Does turning off Wi-Fi prove an app works offline?

It proves the strong half of the claim, which is worth a lot. If a transcription finishes with the network off, no server saw that audio. There is no way around that: the bytes had nowhere to go.

Do it properly. Turn off Wi-Fi from Control Centre, and also unplug Ethernet, disconnect any iPhone tethered over USB, and turn off Personal Hotspot. A Mac will happily route through a phone plugged in to charge. Then quit the app completely and relaunch it, because an app that already holds an open connection may keep using it.

Watch for the softer failure too. Some apps do not error when offline, they silently produce a worse result from a small local fallback and a good one when online. If the output quality changes noticeably between the two runs, the good version came from somewhere else.

The limit of this test is real and you should hold on to it: it proves the feature can work offline. It does not prove the app declines to send anything when the network is back.

What should I look at in Activity Monitor?

Two tabs, both built in to macOS. Open Activity Monitor from Applications, Utilities.

The CPU tab answers whether your own machine did the work. Sort by % CPU and run the task. Local speech recognition, text recognition or image work will push one process to a large share of CPU, often several hundred percent across cores, for as long as the job takes. A flat CPU line during a two minute transcription means those two minutes of work happened elsewhere. The reverse is not proof: a busy CPU can be video decoding, UI animation or an unrelated process, so treat high CPU as consistent with local work rather than evidence of it.

The Network tab answers whether bytes left. It has Sent Bytes and Rcvd Bytes columns showing cumulative totals per process since it started. Note the app's Sent Bytes, run one task, then note it again.

Now do the arithmetic, because this is the part most guides skip. Three minutes of speech is roughly 3 MB of compressed audio, or about 30 MB uncompressed. A ten page scanned PDF is a few megabytes. If Sent Bytes rises by 4 KB after you transcribe a three minute recording, that is a status ping or a licence check, not your recording. If it rises by several megabytes, and rises again in proportion when you feed it a longer file, your content is leaving. The correlation between input size and bytes sent is the single most informative number a non specialist can collect.

Two commands give you the same information more precisely. In Terminal, this prints a one shot per process byte count:

nettop -P -x -J bytes_in,bytes_out -l 1 | grep -i appname

And this lists the sockets an app currently has open:

lsof -i -P -n | grep -i appname

Both ship with macOS. Neither needs an install and neither shows you message contents.

How big should a local AI app be?

Models are large files and they have to live somewhere. Speech recognition models in the Whisper family run from 39 million parameters at the smallest to 1.55 billion at the largest, which on disk means tens of megabytes at the bottom and gigabytes at the top. A small language model for summarising is typically 1 GB to 4 GB. There is no way to run those without the file being present.

So check three places. Right click the app in Applications and choose Get Info for the bundle size. Then look in ~/Library/Application Support/ and ~/Library/Containers/ for a folder named after the app, and check its size in Finder. Some apps also use ~/Library/Caches/.

A 30 MB app that has downloaded nothing, ever, and offers accurate multilingual transcription is not doing that on your Mac. Equally, a small installer is not suspicious on its own: downloading models on first use of a feature is normal and sensible, because it avoids shipping gigabytes to people who will never touch that feature. What matters is whether the download happened at all, and whether the files are still there.

Be careful about direction here. A large download is a model arriving, which is the opposite of your data leaving. Rcvd Bytes going up is expected and fine. Sent Bytes is the column that matters.

What free tools show which servers a Mac app connects to?

macOS does not include an outbound firewall. Look at System Settings, Network, Firewall and every option there concerns incoming connections: block all incoming connections, allow built-in software to receive incoming connections, and so on. Turning it on does nothing to stop an app sending data out. Objective-See, who publish the free tool below, state the same thing plainly: Apple's built-in firewall only blocks incoming connections.

So for outbound visibility you need one of these.

• LuLu, from Objective-See, is a free and open source outbound firewall for macOS 10.15 and later. It prompts on each new outbound connection and lets you allow or block it. It is noisy for the first day and then quiet, which is exactly the shape you want: after the noise dies down, any new prompt is an event worth reading.
• Little Snitch is the long established commercial option, 59 euro for a single licence (checked September 2026). Its separate Little Snitch Mini has free network monitoring, so you can watch connections without paying, though monitoring is not blocking.
• Built in, free, no install: the nettop and lsof commands above, plus sudo tcpdump -i any -n if you want to see destinations at packet level. tcpdump shows you where traffic goes and how much, never what is inside it.

Whichever you use, the valuable output is not a single snapshot. It is a week of history. Leave it running and then ask: does this app open a connection at the exact moment I use the feature, and does it stay quiet when I do not?

The ten minute checklist

1. Note the sizes. Get Info on the app bundle. Check ~/Library/Application Support/ for the app's folder and note its size. About one minute.
2. Open Activity Monitor, Network tab. Find the app, note its Sent Bytes. About one minute.
3. Run one real task online. Use a file whose size you know: a three minute recording, or a ten page PDF. Watch the CPU tab while it runs. About two minutes.
4. Note Sent Bytes again. Subtract. Compare the difference against the size of what you fed it. Kilobytes means telemetry. Megabytes that track your input size means content. About one minute.
5. Go offline properly. Wi-Fi off, Ethernet unplugged, hotspot and USB tethering off. Quit the app and relaunch it. About one minute.
6. Run the same task offline. Does it complete? Is the result as good? About two minutes.
7. Go back online and wait. Do not touch the app for five minutes, then check Sent Bytes once more. A queued upload sent after reconnection shows up here and nowhere else. About two minutes, mostly waiting.
8. Read one sentence of the privacy policy. Find where it describes processing, not storage. About two minutes.

Which test proves what?

Test	What it proves	What it cannot prove	Time
Run the feature with Wi-Fi off	The feature can complete with no network	That the app sends nothing when online	2 min
Sent Bytes before and after a task	Whether bytes left, and roughly how many	What was in them; a compressed upload is small	2 min
CPU load during the task	Whether your Mac did sustained work	Nothing on its own; UI and decoding also use CPU	1 min
Installed size and model files on disk	Whether a model exists locally at all	That the app uses it for every request	2 min
Outbound monitor left running for days	Every destination contacted, and exactly when	Contents, which are encrypted in transit	10 min to set up
Privacy policy wording	What the company has committed to in writing	What the code does	3 min
App Store privacy label	What the developer declared to Apple	Whether processing is local, for the reason below	1 min

How do I read a privacy policy for this?

There is one distinction that carries almost all the weight, and policies are often written to blur it.

We do not store your recordings means the data arrived on a server, was processed there, and was then deleted. Or so the policy says. The data existed on someone else's computer, was readable by that company while it was there, and was in scope for a subpoena, a misconfiguration or a breach during that window.

We never receive your recordings is a completely different claim. It says the data never left your machine, so there is nothing to store, delete, disclose or lose.

Search the policy for the words transmit, send, receive, process, server and third party. Look at what governs the actual feature, not the sentence about newsletter signups. Phrases worth slowing down for: processed securely, processed in a privacy preserving way, we do not train on your data, your data is encrypted in transit. All four are compatible with your data being uploaded. Encrypted in transit specifically means it is being transmitted.

Also read the subprocessor list, if there is one. An app with no servers has no subprocessors for content. An app that names a speech provider or an inference host is telling you where your audio goes, in writing.

Do App Store privacy labels tell you if processing is local?

No, and the reason is written down by Apple. In its guidance to developers on App Privacy Details, Apple defines the key term like this: Collect refers to transmitting data off the device in a way that allows you and/or your third-party partners to access it for a period longer than what is necessary to service the transmitted request in real time.

Read that carefully. An app can send your audio to a server, transcribe it there, return the text, discard the audio, and truthfully show a label that says Data Not Collected. That label is about retention, not about location. A purely local app and a real-time cloud app can display the identical label.

The second limit is that labels are self-declared. Apple's own guidance tells developers they are responsible for keeping their responses accurate and up to date. Nobody instruments the app to check. Treat the label as a statement of intent by the developer, which is useful, and not as a measurement, which it is not.

Have Mac apps actually been caught doing this?

Yes, and the documented cases are worth knowing because they show what the failure looks like.

In September 2018 the security researchers at Objective-See published an analysis of Adware Doctor, then the top grossing paid utility in the Mac App Store at $4.99. Their write-up shows the app reading Safari, Chrome and Firefox history files, packing them into a password protected history.zip using the hardcoded password webtool, and posting that archive to a remote server. The app was validly signed and had passed App Store review. Apple removed it after the research was published.

Days later, several Mac App Store apps published by Trend Micro were removed after researchers reported similar behaviour. Trend Micro publicly confirmed the apps had collected and uploaded a snapshot of browser history covering the 24 hours before installation, said this was for security analysis and disclosed in its terms, removed the capability and deleted the stored logs.

The pattern is not limited to the Mac. In February 2024 the US Federal Trade Commission announced an order requiring Avast to pay $16.5 million and banning it from selling browsing data for advertising, to settle charges that it sold consumers' browsing data after promising its products would block online tracking.

And in August 2019, after reporting by the Guardian, Apple suspended human grading of Siri requests and apologised, stating in its newsroom post that it had immediately suspended human grading and begun a review. Whatever else that episode shows, it shows that data sent to service a request in real time can still be heard by a person.

None of these were caught by reading a privacy policy. They were caught by watching what the software did.

What these tests cannot prove

Be honest with yourself about the ceiling here, because a confident wrong conclusion is worse than an uncertain right one.

• Batching defeats the simple version. An app can process locally, keep a copy, and upload it hours later during an ordinary looking background sync. Your offline test passes and the upload still happens. This is why step seven of the checklist exists, and why days of outbound monitoring beat minutes of it.
• Compression hides volume. Text is tiny. A transcript of a one hour meeting is maybe 60 KB, and compressed it is far less. Byte counting works well for audio, images and documents, and badly for text.
• Encryption hides contents. You can see the destination and the size. You cannot see what was inside without a proxy and a trusted root certificate, which is beyond a normal setup and defeated anyway by certificate pinning.
• Hybrid designs are common and legitimate. An app may run short inputs locally and long ones on a server, or default to local with an enhance quality option that is on. Test the feature you actually use, with the settings you actually have, at the input size you actually feed it.
• Signing and review are not guarantees. Adware Doctor was signed and it was in the Mac App Store.
• You learn nothing about the server. If data does leave, none of this tells you how long it is kept or who else sees it. That is the point of not sending it.

What you can reach, realistically, is a confident answer to a narrower question: does this app need a server to do its job, and does the traffic it generates scale with my content? That is enough to sort tools into two piles, which is what you actually wanted.

What does a clean result look like?

For reference, here is the shape of a passing result on a genuinely local tool. The installer is small, in the single digit megabytes, because it contains no models. On first use of a feature the app downloads a model once, so Rcvd Bytes jumps by hundreds of megabytes and then stops. Every task after that runs with the network off. CPU or GPU load rises for the duration of each job. Sent Bytes increases by a few kilobytes a day and never in proportion to your files, because the only outbound traffic is a licence check carrying a machine fingerprint, a computer name and a key. Our own app, Vocemo, is built to that shape, and the tests on this page work the same way on it as on anything else. For the background on what a Mac can run by itself, see on-device AI on a Mac.

Run the checklist on whatever you already have open. Ten minutes, once, on the app you paste your most sensitive material into, is a good trade.

Questions

How do I know if an app is sending my data to the cloud?

Turn off Wi-Fi, unplug Ethernet, disable any phone tethering, then quit and relaunch the app and use the feature. If it works, that job ran on your Mac. Then reconnect and compare the Sent Bytes column in Activity Monitor's Network tab before and after one task. If the increase is kilobytes it is telemetry; if it is megabytes that scale with your file, your content is being uploaded.

Does turning off Wi-Fi prove an app works offline?

It proves the feature can complete with no network, which no amount of marketing can fake. It does not prove the app sends nothing when you are back online. An app could process locally and still upload a copy later during a routine background sync, so reconnect, wait five minutes without touching the app, and check the Sent Bytes figure again.

Is there a free alternative to Little Snitch on Mac?

Yes. LuLu from Objective-See is a free, open source outbound firewall for macOS 10.15 and later that alerts you whenever an app makes a new outbound connection. Little Snitch Mini also offers its network monitoring for free, though monitoring shows connections rather than blocking them. Without any install, the nettop and lsof commands in Terminal show per-process traffic and open sockets.

Can the built-in Mac firewall stop an app sending data out?

No. Every option in System Settings, Network, Firewall concerns incoming connections: blocking incoming connections, allowing software to receive them, and stealth mode. There is no built-in control over outbound traffic, which is why tools such as LuLu and Little Snitch exist.

Do App Store privacy labels show whether an app processes data on device?

No. Apple's developer guidance defines Collect as transmitting data off the device in a way that allows access for longer than is necessary to service the request in real time. An app that uploads your file, processes it on a server and deletes it can therefore show Data Not Collected. Labels are also self-declared by the developer, not measured by Apple.

Have Mac apps really been caught uploading data they said was private?

Yes. In September 2018 Objective-See published an analysis showing Adware Doctor, then the top grossing paid utility in the Mac App Store, collecting browser history into a password protected archive and uploading it; Apple removed the app. Several Trend Micro Mac App Store apps were removed days later, and the company confirmed they had uploaded a 24 hour snapshot of browser history. In February 2024 the FTC ordered Avast to pay $16.5 million over selling browsing data after promising its products blocked tracking.

Sources

Every price on this page was read from the vendor's own page on the date shown above. Prices change; if you find one out of date, tell us and we will correct it.

• BBC News: Apple settles Siri recording privacy lawsuit
• Apple Intelligence system requirements
• Apple: App privacy details on the App Store
• Lopez v. Apple voice assistant settlement, official notice
• Apple: Use dictation on Mac
• Ollama for macOS
• LM Studio

Competitor prices in this article were checked in September 2026. Prices change; if you find one out of date, write to us and we will correct it.