What actually stays on the device

A precise, feature-by-feature account of which Vehla actions never touch a network, which always do, why vision is cloud-only, and how Recall's split works.

VEHLA / FIELD NOTES
Compare Docs Download Free
PRIVACY

What actually stays on the device

"Runs locally" is doing a lot of work in most marketing copy, including ours. Here is the precise version, feature by feature.

10 MIN READVEHLA 8.5

Almost every AI app on the Mac now claims to be private. Very few of them tell you which specific actions touch a network and which do not, because that list is less flattering than the word "local." This is our list.

The claim and the caveat

The claim: Vehla ships an MLX inference runtime for Apple Silicon, and when Local AI is selected, text-only AI actions run on your Mac. The prompt and the inference stay on the device. We do not proxy or log prompts and outputs through a Vehla inference server, in local mode or cloud mode.

The caveat: Vehla is not an offline app. It is an app with an offline mode, sitting inside a product that also does web search, MCP tool calls, licensing checks, and updates. Those are separate features with separate network behavior, and conflating them is how "private" becomes meaningless.

What runs on-device

With Local AI selected and a downloaded model, these never leave your Mac.

Text AI actions. Rewrite tones, summarize, shorten, expand, grammar, bullets, Markdown, explain, smart compose, translation, to-do extraction, meeting notes, code explain and refactor, shell command generation.
Flow dictation. Speech models — NVIDIA Parakeet, NVIDIA Nemotron, Apple Speech, and Whisper sizes — are downloaded and run locally. Your audio is not uploaded.
Read Aloud with Kokoro. On-device English voices. ElevenLabs voices are the cloud alternative and are opt-in with your own key.
Clipboard image intelligence. OCR text, QR decoding, screenshot details, dimensions and dominant colors are extracted locally. Snipe Text OCR is local too.
Recall retrieval and indexing. Building and searching the index is local, always. What happens after retrieval depends on the model you pick — see below.
Every native command. App launching, file search, window management, clipboard, calculator, symbols, colors, QR, ports, processes, Purge, Shortcuts. No model involved.

What needs a network

These require a connection, and no setting makes them local.

Cloud provider requests. Sent from your Mac directly to OpenAI, Anthropic, Google, DeepSeek, or OpenRouter, using a key stored in macOS Keychain. Not through us.
Web search and agent actions. Research and Reply, Fact Check, and Summarize Webpage fetch URLs or search through your own Brave Search key.
Vision actions. Describe Image, Extract Text from Image via a model, and Ask About This Image route to a cloud provider.
MCP servers. Remote servers receive the prompt and context you choose to share. Local stdio servers stay on your machine.
Store, licensing, updates. Extension installs, license activation, and update checks against an HTTPS manifest with SHA-256 verification.

Model sizes and what they cost you

Local inference is not free — it costs disk, memory, and battery. The catalog:

MODEL SIZE NOTE
Gemma 4 E2B · 4-bit~2.5 GBDefault. Available on Free.
Gemma 4 E4B · 4-bit~4.5 GBHigher quality. Premium.
Gemma 4 E4B · 8-bit~9 GBHighest quality in catalog.
Gemma 4 12B Coder4-bit / 8-bitCode-focused. Premium.

The Free plan covers catalog models up to 2B parameters, which in practice means the E2B default. Premium unlocks up to 12B and lets you import your own MLX-compatible models. Model files can be relocated to another volume from Settings, and models can be warm-started or offloaded when idle so they are not holding memory all day.

Choosing per task

A small on-device model is genuinely good at bounded transformations of text you supply: rewriting for tone, tightening a paragraph, fixing grammar, converting prose to bullets, extracting action items, translating a message, explaining a snippet. The input is right there, the output is short, and there is nothing to hallucinate.

It is meaningfully worse at open-ended reasoning, long-context work across many files, current-events questions, and anything where you would notice a frontier model's judgment. Sending a contract through a 2B model to summarize is fine. Asking it to spot the risky clause is not.

The practical habit that emerges: local for anything you would not paste into a stranger's website, cloud for anything hard. The palette footer switches routes in two keystrokes, so this is a per-task decision rather than a settings decision.

Why vision is cloud-only

The bundled Gemma 4 catalog models are text-only. They cannot process images, so Describe Image, Ask About This Image, and screen-region vision actions route to a configured vision-capable cloud provider. Vehla shows a routing notice when this happens rather than doing it quietly.

There is an important distinction here. Reading text out of an image — Snipe Text, clipboard OCR — is local, because that is OCR rather than a vision model. Asking a question about what is in an image is cloud. If you have no cloud provider configured, the vision actions simply do not run.

Recall's split

Recall is the clearest example of why "local" needs two answers instead of one. The index — across the sources you enable: notes, clipboard history, Shelf items, snippets, canvases, Kanban boards, Deep Research reports, and selected folders — is built and searched entirely on your Mac. That part is unconditional.

Then the retrieved passages get assembled into a prompt and handed to whichever model you selected. Pick a local model and the whole chain stays on the device. Pick a cloud model and the assembled prompt, including the retrieved passages from your notes, goes to that provider. Retrieval being local does not make the answer local, and any product that implies otherwise is being slippery.

Reading the label

The palette footer names the active route — for example Local · Gemma 4 E2B (4-bit) — and the context label above the input names what will be sent: clipboard, selected text, front app, attached files. Between those two lines you can always answer "where is this going and what is going with it" before you press Return.

One behavior worth knowing: if Local AI is selected and the model is unavailable, Vehla shows an error. It does not fall back to a cloud provider. Silent fallback is the single failure that would make every other sentence on this page worthless, so we made it impossible.

What we don't do

COMMITMENTS
No inference proxy: cloud requests go from your Mac to your provider. No prompt or output logging on our side. No collection of your selections, clipboard contents, snippets, personas, or the names of apps you use Vehla in. API keys live in macOS Keychain, not in a config file. Permissions are requested only when a feature needs them, and every one can be revoked in System Settings.

One thing we do collect, and should name here rather than bury: anonymous device and lifecycle analytics, enabled by default, sent to our Supabase database under a random per-installation ID. It exists to tell us which macOS versions and hardware people are actually running. It contains no email, no license key, no files, no clipboard contents, no prompts, no outputs, and no app names, and you can turn it off with Share anonymous system analytics in Settings. The full detail is in the privacy policy.

You should not take any of that on faith, which is the honest weakness of a closed-source app. Little Snitch or a similar network monitor will show you exactly what Vehla talks to, and that is a better basis for trust than this paragraph. If you want the setup that survives a corporate privacy review, the next post walks through it: six ways to give Vehla a model.

Common questions

Does Vehla work offline?

Vehla is not an offline app; it is an app with an offline mode. With Local AI selected and a model downloaded, text AI actions, Flow dictation, Kokoro Read Aloud, clipboard OCR, Recall retrieval, and every native command run with no network. Cloud requests, web search, vision, remote MCP, licensing, and updates need one.

Does Vehla send my prompts to a server?

No. We do not proxy or log prompts and outputs through a Vehla inference server, in local mode or cloud mode. Cloud requests go from your Mac directly to your provider using a key in macOS Keychain.

Why can't local models describe images?

The bundled Gemma 4 catalog models are text-only, so vision actions route to a configured cloud provider with a visible routing notice. Reading text out of an image is different — Snipe Text and clipboard OCR are local, because that is OCR rather than a vision model.

Is Recall local?

The index is built and searched on your Mac, unconditionally. The retrieved passages then go to whichever model you selected — local keeps the chain on-device, cloud sends those passages to that provider. Retrieval being local does not by itself make the answer local.

Will Vehla fall back to the cloud if the local model fails?

No. If Local AI is selected and the model is unavailable, Vehla shows an error.

NEXT

Six ways to give Vehla a model: catalog, MLX, BYOK, Ollama, LM Studio, Lekh