Your records never reach us. We cannot leak what we never hold.

A sweep of the sources for every telemetry pattern returns exactly one hit: the comment of the test that forbids them. That test walks every source file and requires each network destination to be local or on an allow‑list of two entries — the local model host, and the public benchmark download that never runs during a measurement.

Its limit, stated in the source: the test finds calls by pattern, so an exfiltration built another way would escape this test. That is why the behavioural check below exists — watching the real process, not the text.

Everything measured on your data lands in a folder git ignores, deliberately — the code says so in as many words — so no measurement can travel into a repository. The detailed attempt journals, which do hold extracted values, live under that same folder, and for client cases they exist only on an explicit flag: the default is no journal at all.

What a journal header records: CPU model, platform, load. What never enters it: hostname, username, path.

The one network record that is versioned — the egress observation — replaces every path argument with a placeholder before writing, and the committed file shows the substitution live: the observed command reads --cases=<file>. Its verdict: no connection observed for the whole pass, over 21 samples — and the same file states its own limit, that sampling is a floor, not a kernel capture.

The local screen's error messages pass through path‑scrubbing at both return sites, with a dedicated test — and one assumed weakness written in the source: the list of scrubbed roots is a list, so a path under an exotic root would pass.

The local screen listens on this machine's loopback only, and that is locked by a test which sweeps every server in the repository rather than reciting a list. Any write request carrying a foreign origin is refused before it reaches the handler. And the server keeps no request log at all — its only console output is the startup line and port errors; no body, no address, no access is written anywhere.

The tool has one production dependency, the model runtime library. A telemetry sweep across all of its installed packages finds hits only in a development tool's editor protocol — nothing in the production path. The library's single remote destination is the public weights host, used once on first run; the offline flag turns even that off by telling the library never to reach the network — and the library disobeys for one public metadata file on every load, which the tool now refuses by name rather than allows in silence. One more address, found by sweeping the dependencies themselves: a package inside the runtime embeds a CDN host for WASM artefacts, on a path this tool never exercises — named here because a list kept in our sources cannot see inside a dependency.

Declared plainly: native binaries cannot be read by a text sweep, so that corner is not verifiable by grep — its floor is the behavioural egress record above.

The measured report is written beside your CSV, not into the tool's folders. It contains rates, intervals and the questions asked — never the values extracted from your documents — and closes with the sentence it earns: measured on this machine; nothing left it.