Privacy and local-use design
What Blobs keeps on your phone, and when it connects.
On your phone
Blobs routes model inference, library search, citations, reading, conversations, drafts, and settings through local files and app-private storage. It contains no hosted inference service or account flow.
These features read installed files after a model and starter library are present. The 0.5.0 release was exercised in airplane mode on a physical Android phone. The app does not declare a Google Play Services dependency, which is what a GrapheneOS install requires; it has not been run on a GrapheneOS build.
When the app connects
Network requests are limited to actions you start:
- Download a model or library.
- Tap Check for updates to refresh the signed download list.
Opening a screen doesn’t automatically check for updates or start downloads. GitHub distributes the app and source. Hugging Face hosts the package list and downloadable assets; some model files come from their upstream model repositories. Those services receive normal connection information when you ask Blobs to fetch a file, rather than your chat messages.
Download checks
Blobs verifies the signed list, expected file size, and SHA-256 before accepting downloaded assets. Packages also pass format and storage checks before atomic installation. A failed update leaves the previous working asset available.
Read the architecture for the precise signing and rollback boundaries.
Files you share
Exports can contain private messages, imported documents, or source text. Check a file before sending it to another person or service. Removing the app or clearing its Android storage removes local app data; keep any exports you need first.
About this documentation website
This website is separate from the Android app. It serves static pages and a local search index. It includes no analytics scripts, external font requests, or hosted AI search. Your hosting provider still processes ordinary website requests. Theme preference is saved in your browser.
Report a security concern
Use GitHub’s private vulnerability reporting for a suspected security issue. Use public issues for ordinary bugs, and leave private conversations and files out of reports.