What stays local, and what goes to a provider?
To keep dictation fully local, choose local models for both transcription and optional cleanup. Using a local speech model alone does not make a cloud-backed cleanup step local.
- Internal writing models process selected text on your Mac using downloaded MLX weights.
- Local speech models process recordings on your Mac. Audio is held in process memory and discarded after completion or cancellation.
- A cloud writing rule sends the selected text and instructions to its selected provider.
- An Explain answer rule sends its model the selection, its instructions, the surrounding text when Include surrounding text is on, the app’s name, the reply language, and earlier turns in the panel. The page or document address is never sent.
- An external speech model receives the microphone recording for transcription.
- Cloud transcript cleanup sends the transcript and instructions to the selected text provider.
- Ollama and LM Studio process requests at the endpoint you configure; a localhost endpoint runs on your Mac.
Credentials, settings, and history
Direct provider API keys are stored in macOS Keychain. Basic settings live in ~/.config/frog/config; complex rules, connections, and custom models live beside it in config.json. Downloaded weights and private data are separate and excluded from configuration exports.
Result history is off by default. When enabled, it stores text results locally, with configurable retention and entry limits of up to 30 days and 200 records. Audio files are not added to history. Turning history off stops new records; existing records remain until cleared or expired.
Installed coding tools own their authentication and credential refresh. Frog invokes supported CLIs without importing their credentials into Frog’s Keychain. Their selected providers can receive the text and instructions. OpenCode keeps its own CLI session history even when Frog history is off; Frog’s temporary request files are removed. The Frog history switch does not control another tool’s retention.
A processed result is placed on the system clipboard. Clipboard managers can observe clipboard contents, including temporary copies used to work with selections in some applications.
Local aggregate statistics
Settings → Statistics records device-local aggregates: recording count, microphone duration, word count, rule categories, and tool counts. Collection defaults to enabled and can be paused or reset. This is separate from opt-in result history and Mr. Usage; no network requests or telemetry are involved.
The statistics.json file in ~/Library/Application Support/Frog/ contains all-time counters and up to 365 daily buckets. It stores no transcripts, rule names, app names, queries, provider identities, individual event timestamps, or event logs. Existing history is not backfilled. The page offers all-time, 7-day, and 30-day views; words per minute uses total words divided by total microphone time.
Pausing retains existing totals but stops new writes. Reset clears counters and daily buckets while preserving the collection switch; reset recovery from an unreadable file starts paused. The file and collection switch are device-local and excluded from configuration exports.
Search, clipboard, and private toolkit documents
- Command-bar queries search local app names, available window titles, Spotlight filenames, and enabled tools. They are not sent to an LLM. Running a cloud-backed rule is a separate explicit action.
- Learn from your choices, off by default, keeps typed command-bar text (up to 32 characters) and the rows you picked in ~/Library/Application Support/Frog/command-choices.json, readable only by you. It is never exported or sent; Forget learned choices… deletes it.
- Clipboard is off by default and keeps at most 100 text items, with bounded available formatting, in memory only. It clears on disable or quit and never becomes saved history or exported configuration.
- Concealed/transient-marked clipboard text starts hidden and is excluded from command-bar previews. This is not universal password detection or encryption: unmarked passwords can appear as ordinary text.
- Notes and script text persist in ~/.config/frog/Toolkit/toolkit-documents.json with user-only file permissions. This separate local JSON file is not an encrypted vault and is not in configuration exports.
- Note variables read the current clipboard only when you copy a note or paste it from the command bar. Notes that came from the shelf keep file references; deleting such a note does not delete the original file.
- Scripts run explicitly as your user with zsh, a 60-second limit, bounded output, and process-group cleanup. Script output stays in memory unless you copy it; scripts can themselves access files or network services according to their commands.
- Explain writes a note only when you press Save to note: the selection, the answer, follow-ups, the app’s name, and the model, plus the address for one note per answer. The surrounding text is not written.
- App cleaner reads file and folder names in your Library folders, launchd property lists, and the apps’ Info.plist files and code signatures, never other files’ contents. It moves items only to the Trash after a confirmation, sends nothing, and keeps the Put Back list in ~/Library/Application Support/Frog/Cleaner/removals.json for 30 days.
Optional usage collection and power access
Mr. Usage is off by default. Enabling it adds a second menu-bar item and starts local coding-tool readers and provider usage polling, including while the dashboard is closed. Disabling it or quitting Frog removes the item and stops collection. It uses originating-tool credentials, leaves renewing a login to the tool that owns it (starting Claude Code for that with one minimal request when its login has run out), and sends no transcripts to usage endpoints. Cached limit metadata and cooldowns stay in the separate local xyz.beffa.frog.usage defaults domain; only display choices are portable.
Stay awake reads local power and battery state and changes the system sleep setting only after guided access setup and an explicit session start. The administrator password is entered into Terminal’s sudo prompt, never Frog. Its machine-local session marker supports interrupted-session cleanup and is not exported.
Disabling a feature stops its owned shortcuts, polling, observers, panels, and tasks as applicable. It keeps configuration and saved documents; the memory-only clipboard is cleared. Mr. Usage displays your own provider activity, not telemetry sent to Frog.
Accessibility and window information
Accessibility lets Frog read a selection you explicitly invoke a rule on and attempt replacement in the original field. Frog validates the target rather than continuously recording typing.
The window switcher uses Accessibility for window titles and activation. Window identities and recent-use order remain in process memory and are not sent to providers or included in history, logs, or configuration exports. The switcher does not capture screenshots.
With the selection bubble on, Frog watches mouse clicks, scrolling, and the Shift key in other apps, and reads a new selection through Accessibility in memory only. It never copies the selection and never shows in password fields, excluded apps, games, or while secure input is on. While an answer panel is open, Frog watches key presses in other apps for the Escape key only.
While drag to screen edges or Shift zones are on, Frog watches mouse-button and drag events to notice a window drag, without recording them. It then reads the position and size of the window under the pointer a few times at most and reads no window titles.
AI agents and the frog command
Agent access is off by default. While Let AI agents use Frog is on, Frog answers the frog command through ~/Library/Application Support/Frog/agent.sock, a socket only your user account can open; nothing listens on the network. Any program running as your user can then use every command, including running your scripts and reading notes and clipboard history, the same as anything that can already run commands in your shell.
Frog sends nothing anywhere for agents. What an agent does with what it reads follows that agent and its model provider. The skill files and the ~/.local/bin/frog link are files in your home folder that Settings installs and removes.
Downloads and app updates still use the network
Explicit internal-model downloads fetch files from their model repositories and download infrastructure. Adding a custom model source checks public repository metadata before you separately choose to download weights.
Frog’s updater checks the GitHub release feed and downloads updates. Automatic update checks and downloads are configurable. These requests do not contain your writing, microphone recordings, or provider API keys.
This website counts page views and four named events with a self-hosted Umami and loads Umami’s recorder, which collects heatmaps and session replays when they are switched on for the website. Neither script sets cookies or keeps a visitor identifier in the browser. Website analytics is separate from the Mac app, which has no analytics or telemetry. The website does not record a microphone or call a model provider.