Most browser AI asks you to trust one company's model and its data practices at once. Searxly AI separates them: open models, run on-device by default, grounded in your private search, never trained on your chats — with the compute location your choice and the privacy non-negotiable.
When the AI runs locally — Apple Intelligence or your own local model — your prompts, attached files and retrieved context never leave the Mac. You can confirm it with a network monitor. The private cloud exists for when you want more horsepower, but it's strictly opt-in, and turning it on shows you exactly what will leave the machine before anything does.
The default model runs on your Mac. Prompts, attached files and retrieved context never touch a server unless you explicitly choose the cloud.
Enabling Searxly AI shows a first-run egress alert spelling out that prompts, summarized page text and search results would leave the Mac. No surprise uploads.
There is no training on your conversations and no behavioral profile. The intelligence is a tool, not a data-collection funnel.
One switch makes the entire AI layer inert — off until you turn it on, and instantly off again when you want it gone.
Strict privacy mode and panic-wipe clear the AI's on-device memory along with the rest of your local data, instantly.
Tool use is shown in the chat and written to an activity log you can read and export — nothing happens behind your back.
Tools can search privately, open a verified official site, or read a file you attach — but one toggle decides whether they run automatically or ask first, and every action is reversible.
Answers are synthesized from your own local SearXNG with citations — never a public index, never an ad network, never your intent for sale.
Before the model reads page text, it passes through Bulwark — the five-layer prompt-injection shield — so a hostile page can't hijack the assistant.
The private cloud runs open models on independent, decentralized infrastructure rather than a Big-Tech data center built to profile you. But it's still off-device: the prompt and the context you include are sent to the provider that runs the model so it can reply. We don't attach your identity to it and it isn't used to advertise to you — and if you'd rather keep everything local, leave the cloud off. On-device is the default for a reason.
If an AI can only be useful by watching you, it isn't the one we'll ship.