Home/Writing/What uses the network

What a “local” AI assistant still uses the network for

No desktop application sits at zero packets, and any vendor claiming otherwise is rounding. Here is our complete list — and a two-minute test you can run against ours or anyone else's.

“Runs locally” is doing a lot of work in AI marketing at the moment. It is usually true and almost never complete. An application can run inference on your own GPU and still ship usage analytics, sync your conversation history, or hand your prompt to a cloud model whenever the local one struggles.

The useful question is not does it run locally. It is what leaves this machine, to whom, and on whose instruction. That question has a list for an answer, so here is ours.

Every connection we make

Lemonade's outbound connections
Connection When What leaves the machine
Runtime download First run A request for the model runtime. About 1.4 GB comes back.
Model downloads Setup, and when you add a model The name of the model you asked for.
Update checks Periodically The current version, to learn whether a newer one exists.
Licence activation Once, when you activate Your licence key and a one-way hash of the machine. Nothing else. Occasional rechecks confirm the same key.
Connected mail Only if you connect a mailbox The mail request itself, signed in directly with Google or Microsoft. Lemonade has no account in the middle.
Web research Only when permitted, per search The approved search query. Not your documents, not the conversation.
MCP servers Only if you configure one Whatever that server requires. This is your integration and your boundary — we cannot characterise a tool you added.

Six of those seven are things you either set up deliberately or can see coming. The seventh, MCP, is deliberately open — it exists so you can extend the assistant — and that means the honest statement is that we do not control what a server you configured does with a request you approved.

What never leaves

Where the state lives

Lemonade's own state is one folder you can delete. Downloaded models live with the shared runtime, because they are shared, and the trial record is kept by the operating system so that reinstalling does not silently restart it. Those are three locations, all on your disk, and we would rather name them than imply there is only one.

The part that learns

Lemonade's tiered runtime — the one that lets a large sparse model run across VRAM and system RAM — improves by learning which parts of a model your requests tend to need, so it can pre-load them. Anything that "learns from your usage" deserves scrutiny, so:

That is a scheduling optimisation with a privacy boundary drawn around it, and the boundary is described in full in the research report rather than only in a marketing sentence.

Verify it yourself

You should not take our word for any of this, and you do not have to. In rough order of effort, on either platform:

Watch it work (30 seconds)

On Windows, open Resource Monitor (resmon) and go to the Network tab. On Linux, run nethogs or ss -tunp. Then send a long prompt. A local assistant shows CPU and GPU load climbing while its network row stays essentially flat. A cloud one shows the opposite: a burst out, a pause, then a stream back.

Take the network away (1 minute)

Turn on airplane mode, or unplug the cable, and ask a question. If the answer arrives with the models already downloaded, inference is genuinely local. This is the test that cannot be argued with, it works the same on both platforms, and it is the one to run on any tool making the claim.

Block it and keep using it (2 minutes)

On Windows, open Windows Defender Firewall with Advanced Security and add an outbound rule blocking the application's executable. On Linux, launch the AppImage with firejail --net=none, which gives it no network interface at all. Then work normally for a day. Whatever breaks is exactly the list of things that were using the network — for us, that is updates, licence rechecks, mail and web research, and nothing else.

Look at the connections (for the curious)

On Windows, netstat -b in an elevated prompt lists which executable owns each connection, and TCPView from Sysinternals shows the same thing continuously with the remote host attached. On Linux, ss -tunp or lsof -i does the same job.

What to ask any vendor

Five questions. Vague answers to any of them are the answer:

  1. Is there a cloud fallback? Does any prompt ever reach a hosted model — for hard questions, for long documents, when the local model is loading?
  2. What telemetry is collected, and can it be turned off? "Anonymous usage data" is a category, not a disclosure.
  3. Is there an account? An account implies a server that knows who you are and when you used the product.
  4. Where does state live, and can I delete it? Name the folders.
  5. Does it work with the network disconnected? The answer should be yes, with a short and specific list of exceptions.

Our answers, in order: no; none, so nothing to turn off; no account; one app folder plus the shared model directory and an OS-level trial record; and yes, with the six exceptions in the table above.


The product-level version of this page is the privacy section on our home page. If something here does not match what you observe, we want to know: support@aionx.aionapp.org.

Your files never leave the counter.

Try it for 14 days without a card, then buy a perpetual licence for $49 if it earns its place.