What a “local” AI assistant still uses the network for
No desktop application sits at zero packets, and any vendor claiming otherwise is rounding. Here is our complete list — and a two-minute test you can run against ours or anyone else's.
“Runs locally” is doing a lot of work in AI marketing at the moment. It is usually true and almost never complete. An application can run inference on your own GPU and still ship usage analytics, sync your conversation history, or hand your prompt to a cloud model whenever the local one struggles.
The useful question is not does it run locally. It is what leaves this machine, to whom, and on whose instruction. That question has a list for an answer, so here is ours.
Every connection we make
| Connection | When | What leaves the machine |
|---|---|---|
| Runtime download | First run | A request for the model runtime. About 1.4 GB comes back. |
| Model downloads | Setup, and when you add a model | The name of the model you asked for. |
| Update checks | Periodically | The current version, to learn whether a newer one exists. |
| Licence activation | Once, when you activate | Your licence key and a one-way hash of the machine. Nothing else. Occasional rechecks confirm the same key. |
| Connected mail | Only if you connect a mailbox | The mail request itself, signed in directly with Google or Microsoft. Lemonade has no account in the middle. |
| Web research | Only when permitted, per search | The approved search query. Not your documents, not the conversation. |
| MCP servers | Only if you configure one | Whatever that server requires. This is your integration and your boundary — we cannot characterise a tool you added. |
Six of those seven are things you either set up deliberately or can see coming. The seventh, MCP, is deliberately open — it exists so you can extend the assistant — and that means the honest statement is that we do not control what a server you configured does with a request you approved.
What never leaves
- Your documents. Files are read on the machine and indexed on the machine. Indexing is incremental, and the index is a local file.
- Your conversations. There is no sync, no history service, no account to attach them to.
- Your prompts. Inference runs on your hardware. There is no cloud model behind the local one, and no “fall back to the API” path.
- Screen captures. A region grab or window capture is an image handed to the local model, and it stays where every other file stays.
- Behavioural telemetry. There is none. No analytics SDK, no event stream, no feature-usage counters.
Lemonade's own state is one folder you can delete. Downloaded models live with the shared runtime, because they are shared, and the trial record is kept by the operating system so that reinstalling does not silently restart it. Those are three locations, all on your disk, and we would rather name them than imply there is only one.
The part that learns
Lemonade's tiered runtime — the one that lets a large sparse model run across VRAM and system RAM — improves by learning which parts of a model your requests tend to need, so it can pre-load them. Anything that "learns from your usage" deserves scrutiny, so:
- It stores hashed request features, not prompt text.
- It keeps at most 192 learned traces per model, then discards the oldest.
- All of it stays on the machine. None of it is uploaded, aggregated or used for training.
That is a scheduling optimisation with a privacy boundary drawn around it, and the boundary is described in full in the research report rather than only in a marketing sentence.
Verify it yourself
You should not take our word for any of this, and you do not have to. In rough order of effort, on either platform:
Watch it work (30 seconds)
On Windows, open Resource Monitor (resmon) and go to the Network tab. On Linux, run nethogs or ss -tunp. Then send a long prompt. A local assistant shows CPU and GPU load climbing while its network row stays essentially flat. A cloud one shows the opposite: a burst out, a pause, then a stream back.
Take the network away (1 minute)
Turn on airplane mode, or unplug the cable, and ask a question. If the answer arrives with the models already downloaded, inference is genuinely local. This is the test that cannot be argued with, it works the same on both platforms, and it is the one to run on any tool making the claim.
Block it and keep using it (2 minutes)
On Windows, open Windows Defender Firewall with Advanced Security and add an outbound rule blocking the application's executable. On Linux, launch the AppImage with firejail --net=none, which gives it no network interface at all. Then work normally for a day. Whatever breaks is exactly the list of things that were using the network — for us, that is updates, licence rechecks, mail and web research, and nothing else.
Look at the connections (for the curious)
On Windows, netstat -b in an elevated prompt lists which executable owns each connection, and TCPView from Sysinternals shows the same thing continuously with the remote host attached. On Linux, ss -tunp or lsof -i does the same job.
What to ask any vendor
Five questions. Vague answers to any of them are the answer:
- Is there a cloud fallback? Does any prompt ever reach a hosted model — for hard questions, for long documents, when the local model is loading?
- What telemetry is collected, and can it be turned off? "Anonymous usage data" is a category, not a disclosure.
- Is there an account? An account implies a server that knows who you are and when you used the product.
- Where does state live, and can I delete it? Name the folders.
- Does it work with the network disconnected? The answer should be yes, with a short and specific list of exceptions.
Our answers, in order: no; none, so nothing to turn off; no account; one app folder plus the shared model directory and an OS-level trial record; and yes, with the six exceptions in the table above.
The product-level version of this page is the privacy section on our home page. If something here does not match what you observe, we want to know: support@aionx.aionapp.org.