Privacy and threat model

PromptDust is a tool about privacy, so it holds itself to a strict standard.

The four guarantees

1. Read-only. It never creates, modifies, moves, renames, or deletes any file it scans. A test hashes a fixture tree before and after a scan and asserts they are byte-for-byte identical.
2. Local-only scan. The scan makes zero network calls. Nothing you match or measure ever touches the network, and this holds regardless of any other setting. By default the app sends nothing off your machine at all. A continuous-integration check fails the build if any networking crate is linked into the engine, and a second check runs a real scan with the network blocked.
3. Metadata-only. It records sizes, counts, timestamps, and structural facts like a row count, never the content of your conversations. This holds for everything the app emits: its report, any export, and any optional diagnostics or telemetry. A test plants a canary string inside fixture files and asserts it never appears in any output.
4. Inventory, not a verdict. It reports what is present and why it might matter. It never tells you that you are safe, secure, or clean. A lint fails the build on reassurance language.

These are enforced in the open-source engine, not just promised here.

What the app can send, and the consent rules

By default, PromptDust sends nothing off your machine. It has three feedback features, and none of them sends anything without your explicit action.

• Anonymous usage statistics. Off unless you turn them on. Aggregate counts only, tagged with a per-run random identifier that is regenerated every run, so runs cannot be linked to each other or back to you. The exact payload is documented field by field in Telemetry, and promptdust telemetry preview prints it verbatim.
• Crash reports. If the app crashes it writes a redacted report to a local temporary file and tells you where it is. The file stays on your machine. It is sent only if you choose to attach it to a bug report. It holds a technical backtrace, your OS, and the app version, never your scanned files, their paths, or any conversation content. Even writing the local file is opt-out: DO_NOT_TRACK, the PROMPTDUST_NO_CRASH_REPORT switch, or CI turns it off.
• Diagnostics bundle. You generate it yourself with promptdust diagnostics. It is never sent for you.

Each is bound by these rules, without exception:

• You see it first. Nothing leaves before you see exactly what it is.
• Never anything sensitive. No file contents, no scanned-file paths, nothing that identifies you or your machine.
• Always disableable. Usage statistics and crash reports honor DO_NOT_TRACK and a single off switch, and neither runs in CI.
• Open and inspectable. The code is in the open-source repository, and every payload is documented in full.

Identified or managed reporting for organizations is a separate product, not this app.

What data the tool touches

• It reads the metadata of files in a curated set of known AI-tool locations (path, size, modification time) and, for some structured stores, a count (JSONL lines, SQLite rows) obtained without reading content columns.
• It queries system state read-only to assess exposure: whether full-disk encryption is on (fdesetup, manage-bde, lsblk), whether a path is excluded from Time Machine (tmutil), and which folders are cloud-synced.
• It runs as your user account and never requests administrator or root privileges.

It does not read message content and does not open or transmit your files. The only things it writes to disk are: a report when you explicitly export one; if you enable telemetry, the one-time record of that choice; and, if the app ever crashes, a redacted crash report in a temporary folder, which stays on your machine unless you choose to share it.

What it protects against

The concern is the confidentiality of unexpectedly-persisted local AI data. AI tools keep the content of your conversations on disk, usually in plain text, in places you never chose and mostly do not know about. Anything with read access to your home directory can read it: local malware, a borrowed or stolen unlocked laptop, an over-broad backup, a misconfigured cloud sync. The tool’s job is discovery and exposure assessment. It makes that invisible footprint visible so you can manage it.

What it deliberately does not do

• It is not an antivirus, a data-loss-prevention agent, or a cleaner.
• It does not stop data being sent to AI models. That is a different problem.
• It does not scan phones directly, because mobile operating systems sandbox against it. A future version may scan unencrypted phone backups that already sit on your computer.
• It does not remove or fix anything automatically. Remediation is your choice, guided by the suggestions it prints.

The exported report is sensitive

If you export a report, it contains a map of where sensitive AI data lives on your machine. Treat that file as sensitive: keep it off shared or synced locations, and delete it when you are done. The tool warns you about this every time you export.