What leaves your Mac, and what does not

The four moments something leaves your Mac

Nothing is sent in the background, on a schedule, or while you browse. Each of these happens because you did something, and three of the four say what they will cost before they run.

Importing a link

The saved page is fetched from the site that hosts it, exactly as a browser would, and the text of it — up to about four thousand characters — is sent to the model that writes the one-line description. No JavaScript is run, so a page that renders itself entirely in the browser gives up nothing and is described from its title and domain instead.

Pressing Return on a search

The words you typed are sent to be turned into a list of numbers. That is the whole of it — your library is never sent, and the comparison against it happens on your Mac.

Asking Unbury a question

The question, the conversation so far, and the results of the searches it runs go to whichever engine you chose in Settings: Claude Code or Codex running on this Mac, or a model on OpenRouter.

Showing a preview picture

Results and lists show the preview image a page declares. That image is fetched from the site that hosts it, so those sites see a request from your Mac. Around a third of links have no preview image at all and nothing is fetched for them.

Two more requests exist and are worth naming even though they carry nothing of yours. When you paste an API key, Unbury asks the provider whether the key is valid — the cheapest question each one allows, and it buys nothing. And once a day at most the app asks GitHub for a signed list of releases, to know whether a newer version exists.

Who receives it, and under whose terms

Unbury has no models of its own. Everything above that involves a model goes to a company you hold an account with, using a key you pasted in yourself, and what they do with it is governed by their terms rather than by anything on this page.

• OpenRouter, by default, for turning text into numbers and for writing descriptions. You can point the first of those at OpenAI instead, with an OpenAI key.
• Anthropic or OpenAI, if you choose Claude Code or Codex to describe pages or to answer in Ask Unbury. Those are separate programs already on your Mac, running under your own subscription, and Unbury hands them a question by running a command.
• The websites you bookmarked, when a page is fetched to be described or a preview image is loaded. They see an ordinary request from your address, with a User-Agent that names the app.
• GitHub, for the update check and the download itself.

There is no fifth party. No analytics service, no error reporter, no advertising identifier, and nothing that phones this project — because this project has nowhere for it to phone.

What Unbury reads on your Mac

Only your browsers’ bookmark files, and only the ones you point it at. It reads them; it never writes to them. Deleting a link in your browser does not delete it in Unbury, and nothing Unbury does can change what is in your browser.

Google/Chrome/

Chrome, per profile.

BraveSoftware/Brave-Browser/

Brave, per profile.

Arc/User Data/

Arc, per profile.

Microsoft Edge/

Edge, per profile.

Vivaldi/

Vivaldi, per profile.

All five sit inside ~/Library/Application Support. Safari and Firefox keep bookmarks in a different format and are not read at all. Alongside each browser’s bookmarks Unbury reads its Local State file, which is where the browser records what you named each profile — without it the import sheet offers you a list of identical "Profile 4"s.

Before importing anything, Unbury shows you which profiles it found, how many links are new, and roughly what the import will cost. Nothing is fetched, described or spent until you press the button.

What Unbury writes, and where

Everything here stays on your Mac. Nothing in this table is sent anywhere.

~/Library/Application Support/Unbury/vault.json

Your links, their descriptions and their tags. Plain text — you can open it in any editor and read every word of it.

~/Library/Application Support/Unbury/vectors.bin

The numbers each search is ranked against. A flat block of 32-bit floats, about 3 MB for 600 links together with the vault.

~/Library/Application Support/Unbury/conversations/

Ask Unbury conversations, one file each, with an index beside them. Deleting a conversation in the app deletes its file.

~/Library/Application Support/Unbury/settings.json

Your choices: which models, which engine answers, which browser profile you import from. No key is ever written here.

macOS Keychain, service com.migsilva.unbury

Your API keys, one per provider, kept where macOS keeps secrets rather than in a file beside the data.

To remove everything Unbury holds, delete that folder and remove the keys from Keychain Access. There is no account to close and no request to make of anyone, because nothing about you exists anywhere else.

Updates, and how to stop the automatic check

Once a day at most, Unbury asks GitHub for a signed list of releases attached to the latest one. Sparkle — the standard macOS update framework — verifies the signature before Unbury trusts the list. No document, identifier or system profile is sent. GitHub receives the ordinary details of a web request, including your IP address.

Finding an update does not download it. The disk image is fetched from the same GitHub release only when you choose to install, and it is signed with a Developer ID and notarised by Apple; Sparkle checks it before replacing the app.

To stop the automatic check, turn it off in Settings. Checking by hand from the Unbury menu still works whenever you want it.

You do not have to take any of this on trust

Unbury is open source under the MIT licence. Every claim on this page is a line of code somebody can read, and a request somebody can watch — Activity Monitor will show you the bytes, and a firewall will name the hosts.

If you find something this page does not describe, that is a bug in the page and worth an issue on the repository.