SearchAF runs on your Mac. We run no servers that see your data.

What stays on your device

• File contents. Files you index — including OCR text, transcripts, captions, and embeddings — are stored only in ~/.searchaf/.
• Queries. Every search runs against the local index. Nothing is sent to a remote search service.
• History. Recent queries are kept in memory and cleared when SearchAF quits. Settings → General → “Clear search history” empties them immediately.
• Logs. Process logs (~/.searchaf/swarm.log and ~/.searchaf/electron.log, plus rotated *.gz archives) stay on disk locally and are never uploaded automatically.

What goes over the network

Out of the box, these are the only network calls SearchAF makes, all initiated by the app itself for a specific purpose:

If you connect Answers to a cloud AI provider, there is a third kind of network call — covered in the next section.

Indexing never triggers a network fetch on its own. If a file in a watched folder is iCloud-evicted (stored in the cloud rather than on disk), SearchAF detects that and skips it instead of forcing a download.

Answers and cloud AI providers

Answers — the ask-a-question feature — needs a language model, and you choose where it runs. Nothing is sent anywhere until you pick an engine in Settings → Answers:

• On-device model. SearchAF downloads a local model (via the HuggingFace call above) and everything — your question, your files, the answer — stays on your Mac.
• Your own cloud key. You can instead connect a provider you already use: OpenAI, Anthropic, Google Gemini, OpenRouter, or any OpenAI-compatible endpoint you supply. When you ask a question, SearchAF sends that provider your question, excerpts of the matching indexed files (their text, OCR text, image captions and tags, and file metadata), and the conversation so far. That call goes directly from your Mac to the provider — we never see it — and the data is handled under that provider’s terms, not ours.

API keys are stored in the macOS Keychain, never written to disk. Plain search never uses the Answers engine: even with a cloud provider connected, searching your files stays entirely local.

Local agents (MCP)

SearchAF exposes a local MCP endpoint so agents running on your Mac can search your index. It listens on loopback only — nothing off your machine can reach it — and returns the same read-only results as the search UI. It is on by default; turn it off with Settings → Answers → “Let other apps search with SearchAF”.

Telemetry

SearchAF ships with no telemetry of any kind. No analytics ping, no error reporting, no funnel events. If we ever introduce anything, it will be opt-in via a single Settings toggle that is off by default.

Diagnostic bundles

If you click Settings → “Save diagnostic bundle”, SearchAF writes a zip to a location you choose. The bundle contains your logs and a copy of config.json with file paths replaced by placeholders (<HOME>, <watch:0>, <searchaf>/data, etc.) so you can share it with support without leaking your folder structure. Nothing is sent automatically — the file lands wherever you point the save dialog.

Deleting your data

Settings → “Danger zone” → “Delete all indexed data” wipes ~/.searchaf/data and clears in-memory search history. There is also an opt-in checkbox to delete downloaded models. Files on your disk outside ~/.searchaf/ are never touched. After deleting, SearchAF closes; reopen it for a fresh index.

To remove SearchAF entirely:

rm -rf ~/.searchaf
rm -rf "~/Library/Caches/io.antfly.searchaf"

…and drag SearchAF.app to the Trash. Downloaded models live separately in ~/.antfly/inference/models/ (they are shared with other Antfly tools); delete that directory too if nothing else on your machine uses them.

This website

searchaf.com is the one place where we do collect something, and here is all of it:

• The download form. The email address you enter is stored in a spreadsheet we control (hosted by Google) and used to send exactly two emails: your download link, and one check-in a month later to ask how it’s going. Anything beyond those two is opt-in.
• Analytics. The site uses Google Analytics via Google Tag Manager, and only if you accept the cookie banner — analytics and ad storage are denied by default. The app never talks to this website.

Questions

If something here is unclear, you want to verify a behavior, or you want your email removed from the download list, write to privacy@antfly.io — a human reads it.