Nothing leaves your Mac.
Nightlatch's promise is structural: detection runs in a short-lived Rust collector on your Mac, the UI only narrates, and there are no accounts, telemetry, or cloud AI calls in v0.1.
Porch Light (v1.0), Nightlatch’s resource-shape indicator, is fully local too — scores never leave the Mac.
What stays on your Mac
- Baseline snapshot under Application Support / ~/.nightlatch-style paths
- Append-only timeline of changes
- Last scan JSON (for the menu-bar UI)
- Metadata only: paths, labels, hashes, flags, port/process names
- Baseline bundle includes a local HMAC (key mode 0600)
- Tamper or corruption surfaces as a coverage gap — never as Quiet
- No vendor key, no phone-home verification
What is never stored or exported
- Full ProgramArguments values (count + hash only)
- File contents, .env values, clipboard, screenshots
- Passwords, browsing history, or raw packet payloads
- Telemetry, analytics events, or account identifiers
Export (nightlatch-core export --format markdown) is redacted by design.
Permissions — and why "Monitoring incomplete" exists
Some macOS sensors need your permission to be fully visible. Nightlatch never pretends it saw everything when it did not.
- Ok — sensor read succeeded
- Limited — partial view (e.g., TCC privacy grants without Full Disk Access)
- Unavailable — sensor timed out or failed
Any gap keeps the menu bar out of Quiet. This is intentional product honesty, not a bug.
Granting Full Disk Access improves privacy-database (TCC) coverage. Nothing else changes: still no network calls, still local-only. You can run fully without it and still get persistence, remote, and listener drift.
Authority boundary
Rust sensors detect and diff. The SwiftUI menu bar narrates. No process kill, file delete, quarantine, network block, or AI execution authority in v0.1. Future optional explanations (v2) will receive only user-approved redacted summaries.