Local by default. By design.
PKMA is built to be a tool you can trust with a folder of your own writing. The short version: nothing leaves your machine unless you explicitly point it at a cloud model.
What stays on your machine
- Your vault. PKMA reads files directly from disk; it never copies them anywhere.
- Embeddings, chunks, and the search index — all stored locally in PKMA's app data directory.
- Chat history and agent transcripts.
- Provider credentials, encrypted at rest using your OS keychain.
What leaves your machine
PKMA will only ever talk to a network when you select a cloud provider (OpenAI, Anthropic, Google, or any OpenAI-compatible endpoint you configure) for a chat or embedding model. In that case the only traffic is:
- The model call itself — the prompt, retrieved vault excerpts, and any tool results — going directly from your machine to the provider you chose.
- Nothing is proxied through PKMA's infrastructure. There is no PKMA infrastructure.
If you stay on a local provider (Ollama, llama.cpp, LM Studio) PKMA makes zero outbound connections after launch.
What we don't do
Not collected, ever
No accounts. No telemetry. No analytics. No crash reports auto-sent anywhere. No "anonymous usage statistics" toggle that's secretly on. There is no server-side component to PKMA — the app is the whole product.
Updates
PKMA periodically checks git.hegdeatri.com for a new
release. This is the only outbound network activity the app makes on
its own; everything else is initiated by you.
- The check is an HTTPS request to the release manifest on the source repo. No identifiers are attached to it — what the server sees is what any web request reveals: an IP address and a user-agent string.
- No vault content, prompts, settings, or usage data are sent with the update check.
- The check can be disabled in PKMA's settings if you'd rather check manually.
- Updates are not installed automatically; PKMA only tells you that one is available.
Server access logs for git.hegdeatri.com follow the same
retention as the rest of this site (see below).
This website
No analytics, no cookies, no tracking pixels. It's a static site served from the same host as the source repo. Web server access logs (IP, user-agent, requested path) exist for ~14 days for abuse mitigation and then are deleted.
If this ever changes
Any change to this posture will be called out in the changelog with a version bump, and this page will be updated. The whole point of PKMA is that you don't have to trust me on this — the source is right there, and the network panel of your OS will agree.