private ai on your mac: how on device memory works

there's a reason you'd never install a cloud ai that watches your messages, your browsing and your camera roll, even though it would obviously be useful. the usefulness was never the question. the upload was.

that instinct is right. it's also solvable now. a private ai on your mac got good enough that the most useful version of a personal memory tool no longer needs to ship your life to a server. here's how that works, and more usefully, how to tell whether an app really does it or just says so, as of september 2026.

why did on device stop being a compromise?

for most of the last decade, local ai meant worse ai. the wider local first software argument had the same problem: the principle was good and the products were not. you took a slower, dumber model in exchange for privacy, and most people quietly took the cloud instead.

two things changed that on the mac.

the apple silicon neural engine. every m series chip ships with one alongside unified memory, so the gpu and cpu share a single pool instead of copying tensors back and forth. vision work like ocr, reading text out of a screenshot, went from an expensive background job to something that runs continuously without the fan noticing. apple's vision framework does it on device by default.

and local ai mac tooling grew up. lm studio and ollama turned "run a model on your laptop" from a weekend project into a download. models in the 7b to 30b range run comfortably on a decent mac and are genuinely capable at the job that matters here, which is reading retrieved context and answering from it. that's a much easier task than open ended reasoning, which is why local models punch above their weight in memory apps specifically.

put those together and the maths flips. the private version isn't the worse version anymore.

that changes what is buildable. on device ai memory, a privacy first second brain, a private screen recorder mac users can actually leave running: all three stopped being compromises at roughly the same moment.

what actually happens on your mac?

here's the pipeline, and where the privacy boundary sits at each step. the category overview, if you want it first, is screen memory: the complete guide.

capture. the app records the screen. a well built one is selective, grabbing the focused window rather than every pixel of every display, and skipping frames when nothing changed. less data captured is less data to protect. this step is always local. there's no version of screen capture that isn't.

ocr. each frame gets read for text using apple's vision framework on the neural engine. people assume this has to be a cloud call and on a mac it simply isn't. the words come out on your machine.

indexing. extracted text goes into local databases. full text search for exact matches, vector embeddings for meaning based ones. embeddings can be generated locally too. at this point you have a complete searchable memory that has never touched a network.

inference. this is the one honest fork in the road. you ask a question, the app pulls relevant slices of your history and hands them to a language model.

if that model runs locally, through something like lm studio or ollama, the loop closes on your mac. if it is a frontier cloud model, the retrieved context goes out. this is the step to check in any tool you are evaluating, because it is the one most likely to be described vaguely.

storage and backup. your archive sits on your disk. if you want it backed up or synced, that should be encrypted and, more importantly, portable to storage you own.

here is the whole pipeline with the boundary marked at each step.

why does any of this matter enough to bother?

because the alternative is handing your entire working life to whoever wins the next acquisition.

the demand for this is real and measurable. per the anthropic economic index for may 2026, the number one work task in sampled ai conversations is searching electronic sources for information at 4.95%, with reference searching second at 3.74%. but the topics that would need a personal archive stay tiny.

every large vendor has now attacked this from the side it controls. microsoft built recall into windows, announced may 2024, paused june 2024, rebuilt with biometric gating and on device encryption, which we assessed in is microsoft recall safe. apple shipped siri ai with onscreen awareness and personal context on june 8, 2026. openai shipped a background memory system on june 4, 2026 and anthropic reworked claude's into editable entries on july 10, 2026.

none of them gives you the archive. that is the gap a private ai on your mac fills, and it is why the storage question outranks the feature question.

how do you audit a privacy claim in ten minutes?

marketing pages are unreliable here and the category has a bad habit of absolutism. some practical tests.

ask what the default is, not what's possible. "can run locally" and "runs locally unless you change something" are very different products. check which one you get out of the box.

watch for absolutes. when an app promises that no data whatsoever ever reaches a network, treat that as a yellow flag, not a green one. nearly every real app makes some network calls. sign in, licence checks, crash reporting, update checks. an honest vendor scopes the claim to the thing that actually matters, which is your captured memory. vagueness in the direction of "totally private" usually means nobody thought carefully about where the boundary is.

find out who holds the keys. encrypted at rest means nothing if the provider holds the key. ask whether encryption is under your key, and whether you can move the whole archive somewhere you control.

check the exit. can you export everything to your own storage? that's the best single proxy for whether a company thinks of your memory as yours. it's also the practical lesson of the past year. rewind ai, which defined this category, was acquired by meta and stopped recording for good on december 19, 2025, roughly 14 days after the announcement, with 7 markets losing access immediately. anyone who couldn't take their archive elsewhere didn't have a memory. they had a subscription. the full pattern is in what happens to your data when an ai app shuts down.

read for two separate promises. "we don't sell your data" and "we don't train on your data" are different sentences. you want both, explicitly.

if you want the short version, this is the checklist:

1. what is the default, not what is possible.
2. who holds the encryption key, you or the vendor.
3. can you export everything, in a format something else opens.
4. what can the ai reach, and is your history read only.
5. what happens on acquisition, which the privacy policy's merger clause already answers.

check what the ai can reach. an agent with unrestricted filesystem access is a different risk from one whose access is read only and scoped through a defined set of tools. ask which it is.

where remynd draws the line

we built remynd around this exact boundary, and we'd rather state it precisely than impressively.

capture and ocr run on your mac, on device, by default, and your archive is stored locally by default. call transcription is on device too: it runs an mlx speech model on apple silicon rather than uploading your audio.

the inference step is where we are cloud today. asking a question about your history sends the retrieved slices to a frontier model, and we do not currently ship a local model option or a bring your own endpoint setting. we would rather say that plainly than let "on device" imply the whole pipeline. what stays local is capture, ocr, transcription and storage, which is the part that decides where your archive lives.

cloud backup exists and is entirely optional. when you use it, it's encrypted and you can export it to your own s3 bucket at any time. that's the promise we're comfortable making in public: your memory is never in our cloud, it's in your bucket, with your keys, portable, never pooled, never trained on, never sold.

be precise about what that does and does not cover. your history is read only everywhere in the app, so nothing the ai does can rewrite or delete your archive. that is a real guarantee and we hold to it.

what it is not is a sandbox around the whole app. remynd's in app chat ships general purpose tools, including shell, python, applescript and http, so an instruction you give it can reach beyond your history the way any terminal can. that is a deliberate capability and it is also a real attack surface, particularly against prompt injection through content the model retrieves. treat it the way you would treat running a script somebody sent you, and see how to give an ai agent context for how we think about scoping agent access generally.

and the footnote we'd rather you hear from us than find in little snitch: like any mac app, remynd talks to the network for account sign in and crash reporting. that isn't your memory. but you should know it.

the point

privacy in this category isn't a feature you bolt on at the end. it's a decision about where the data lives, made once, at the architecture level, and everything else follows from it. an app that captures your entire working life should be one you'd be comfortable running even if you didn't trust the company that made it.

that's the bar. worth holding tools to it, including ours. the four questions to ask of any of them are set out in is it safe to let ai see your screen. remynd vs microsoft recall applies it to the one other mainstream implementation, remynd vs screenpipe to the open source one, and the best second brain apps in 2026 to the wider field.

download remynd free for mac → on device capture and ocr. bring your own model. your bucket, your keys.