Privacy isn't a setting. It's the architecture.
DocGraph is privacy-by-design — a core part of what it is, not a checkbox. We hold ourselves to one discipline: we never put a privacy claim on this page that a shipped mechanism doesn't actually enforce. Here's what the architecture backs, by default.
- 01
Local-first
Your vault is plain HTML files on your machine. DocGraph is a lens over them, not a container for them — open them in any editor, back them up however you like, leave at any time. There is no proprietary format to escape.
- 02
Private by default
Network egress is default-deny and allowlisted. A note cannot silently load a remote tracking pixel, font, or script — and when something does reach the network, it's surfaced to you live.
- 03
No cloud, no account, no telemetry
By default, and no silent cloud ever. There's nothing to sign up for, no analytics beacon, no usage phoning home.
- 04
AI runs locally
Chat runs on Ollama and embeddings run in-process inside the app. Nothing about your notes leaves the machine for the AI to work.
- 05
Free, with an open plugin ecosystem
The app is free — no account, no paid tier, nothing held back. The plugin SDK, registry and example plugins are open source under the MIT licence, so anything you extend DocGraph with is code you can read.
A note on what we don't claim
We phrase privacy as "by default" because that's exactly what the architecture guarantees. Optional features that send data — like remote git sync — are opt-in, clearly marked, and shown to you when active. If a protection isn't fully shipped and enforced, you won't see it marketed here as a guarantee.
Don't take our word for it.
Every request DocGraph makes is surfaced live in the app. Watch the network panel yourself — the quietest app you'll run today.