What Hashling sends, and to whom

Hashling runs on your Mac. It has no account, no analytics and no tracking, and it never uploads your files. This page lists every connection it makes, so you can check for yourself.

Last updated October 26, 2026

The short version

  • Nothing is sent to us. There is no sign-up, no analytics, no crash reporting and no ads. We never receive anything about you or your Mac.
  • What Hashling learns stays on your Mac, in a folder only your user account can open (~/.hashling). Removing Hashling removes it.
  • Your files never leave your computer. The only things that go out are what you ask the AI you chose, and short fingerprints or addresses sent to the free security services listed below.

When you use AI

Hashling's assistant

When you ask a question, the question and the findings Hashling looks up to answer it go to Anthropic (Claude), through your Claude Code sign-in or your own API key. Anthropic's privacy policy covers that. Your API key is kept on your Mac, and we never see it.

Fully local mode

Questions are answered by a model running on your Mac, so nothing is sent anywhere. Setting it up downloads the model once from Hugging Face and the llama.cpp program from Homebrew.

Your own AI app

If you connect Claude, ChatGPT, Cursor or another AI app to Hashling, that app reads what it asks for and sends it to its own provider, under that app's terms. It can only read. Changes always wait for your Touch ID.

AI turned off

You can switch the assistant off in Settings. Every check still runs; only the chat stops.

Connections Hashling makes by itself

GitHub
Sends: nothing about you. Asks whether a newer Hashling has been released, soon after starting and then every 6 hours. Downloads the update only when you click Update now.
Public threat lists
Sends: nothing. Every few hours Hashling downloads public lists of known-bad servers and phishing sites (abuse.ch Feodo Tracker, ThreatFox and URLhaus, Spamhaus, Emerging Threats, FireHOL, Phishing.Database and OpenPhish), then checks your connections against them on your Mac.
Malware rules
Sends: nothing. Once a week it downloads free malware-detection rules from YARA-Forge and Elastic on GitHub. If you installed ClamAV, its own updater fetches new signatures too.
Team Cymru
Sends: the internet addresses your Mac connects to. A small lookup tells Hashling which company runs each server, so it can say "Apple" instead of a number. Hashling also asks your usual DNS provider for each server's name.
Team Cymru and CIRCL
Sends: the fingerprint (SHA-1 hash) of new downloads and apps, never the file. This tells Hashling whether a file is known malware or known-safe software, once per new file.
Homebrew
Sends: nothing about you. If Homebrew is on your Mac, Hashling asks it once a day which of your apps have newer versions.

Only when you use a feature

Breach watch
Sends: the email addresses you add. They go to XposedOrNot, a free breach database, at most once a day, to see whether they showed up in a leak. Nothing is sent until you add an address.
Leaked password check
Sends: the first 5 characters of your password's fingerprint. Have I Been Pwned returns hundreds of possible matches and your browser compares them. Neither Hashling nor the service ever sees the password.
Phone check-up
Sends: nothing from your phone. Hashling asks Apple for the newest iOS version and downloads a public list of stalkerware signs. The first time, it installs the free tools it needs from Homebrew and the Python package index, including Amnesty International's MVT. Everything read from your phone stays on your Mac.

What stays on your Mac

Findings, the history of programs and network activity, scan results, your settings and your API key all live in ~/.hashling. The dashboard only answers on your own Mac and opens with Touch ID. Hashling clears old history by itself: network traffic after a week, the list of programs that ran after a few days (a month for anything it flagged), and alerts after a month.

This website

Our website, gethashling.com, is hosted by Vercel, which keeps standard server logs such as your IP address. It loads its fonts from Google Fonts and the founder photo from GitHub, and the Get started page asks GitHub which installer is newest. Downloads come from GitHub. There are no cookies and no analytics. If you pick light or dark mode, your browser remembers it.

Check it yourself

Hashling is open source, so you don't have to take our word for it. Every connection above is in the code: src/intel, src/updates.ts and src/ai.ts.

If what Hashling sends ever changes, we will update this page and the changelog first. Questions? Open an issue on GitHub and we will answer. Hashling is free under the MIT License, which also covers the terms of use.