Verified against the source of app version 1.3.5.
Kepter's whole pitch is that your files stay on your Mac. That is a claim, and claims are cheap. This page is the rule we hold ourselves to: a claim doesn't go on kepter.app, in an App Store listing, or in a social post until it's verified against the shipping code and listed here first, with how we checked it. If a claim on the site and a claim on this page ever disagree, this page is right and the site is wrong; tell us.
Anything we couldn't verify against the code is left off this page. We do not write "we believe."
In version 1.3.5, here's every place the shipping Mac app can reach the network, and what has to happen for each one to fire. This list is written to be re-checked, not counted and bragged about.
billing.kepter.app): fires when you open the plan panel or press Cancel Subscription…. Kepter sends one thing, your Kepter code, in the body of the request. We run this server, so the answer to your plan or your cancel comes back inside the app. No file, file name or anything Kepter read goes with it.https://kepter.app/appcast.xml): fires automatically for a real .app bundle. The request carries the app version and your macOS version, and nothing about what you've saved. When a newer version exists, Kepter downloads it from downloads.kepter.app, checks it against a signature built into the app, and installs it the next time you've stepped away from your Mac. “Check for updates automatically” and “Install updates automatically” are in Settings, under Privacy & Security, and both are on until you turn them off. Kepter from Setapp makes no update check: Setapp updates it.api.revenuecat.com): The SDK is configured when Kepter launches and makes its own calls from then on: it signs in as your Kepter code, reads whether you have an active plan, and fetches current prices. That happens at launch, not only when you buy. What goes to RevenueCat is the Kepter code, a random identifier generated on your Mac and held in your keychain, together with the purchase itself. No file, no file name, and no file contents go with it. Buying opens pay.rev.cat in your browser, and card details are handled there by Stripe; they never touch Kepter or any server of ours.nom.telemetrydeck.com): new in 1.3.4. Kepter sends anonymous usage events, like finishing setup, the first sweep, opening the plan panel and a purchase, with the app and macOS version, the kind of Mac chip, screen size, language, region and time zone. The Mac's model is replaced with "Mac" before it's sent. The ID is a random one the TelemetryDeck code makes on this Mac, hashed before it goes. It's not your Kepter code, so an event can't be matched to a purchase. No file, file name, folder name or search goes with it. It's off with Share Analytics in Settings, under Privacy & Security; on unless you turn it off in the download, off unless you turn it on in Setapp. From 1.3.5, crash and performance summaries from Apple's MetricKit go the same way under the same switch: the type of problem, exception and signal numbers and up to 8 offsets in Kepter's own binary, no paths.Text extraction runs through Apple's on-device frameworks only: PDFKit for document text, Vision for OCR, and, on macOS 26 and up, Apple's on-device Foundation Models for the genre, a one-line glance fact, and the plain-words nicknames people actually search by. None of these calls leave the machine. A search for AI vendor hosts and API key headers across the whole reading path turns up nothing wired into the live code path.
Audio and video get a transcript only if the Mac's speech recognizer reports on-device support. If it does not, Kepter skips transcription rather than falling back to a cloud speech service, which would be a real files-leave-your-Mac exception. The file is still kept and still findable by name; it's just not searchable by what was said.
Per file, Kepter's local store keeps three things: a thumbnail, the memory record (extracted text, dates, amounts, plain-words nicknames), and the path back to the original. It never writes the file's own bytes into its store. This was proven against the whole 2026-08-29 test corpus at once: every keepable file in the corpus was run through the real ingest path, and the store's blob directory stayed empty.
Deleting an item in Kepter moves the real file to the macOS Trash, the same mechanism Finder uses. It's recoverable. Kepter only forgets its own record once it has re-checked that the file is actually gone from its path; a file that failed to trash stays visible.
Two documents are only ever treated as the same file when they are byte-identical or render identically. Everything else short of that goes through a resemblance check requiring a minimum count of shared rare phrases before two documents can even be compared, and a high resemblance threshold to call something a version. Near-identical images are never called duplicates; they surface as "related, you decide."
Re-run against commit 32d2c96 on 2026-09-07:
| suite | location | tests | result |
|---|---|---|---|
| crypto | crypto/Tests | 21 | all passing |
| shared | shared/Tests | 176 | all passing |
| Mac app | kepterui/Tests | 137 | all passing |
| total | 334 | all passing |
The crypto suite covers key wrapping, content addressing, and chunked sealing. The shared suite covers the on-device reader, ingest policy, the no-copy guarantee above, and the storage-client request contract. The Mac-app suite covers document rendering and the duplicate/version clustering rules above.
32d2c96 of the Kepter Mac app source. Nothing on this page describes a plan, a roadmap item, or code that exists but isn't wired into what ships; anything we couldn't verify against the code was left off rather than softened.