Skip to content
anonymizer

What leaves your machine

anonymizer is built on a single hard rule: the redaction engine never opens a socket. This page enumerates every network request the product can possibly make and when.

During redaction — nothing

Zero outbound requests. Zero loopback requests except the local browser ↔ web UI traffic on 127.0.0.1. Enforced by a build-time integration test which fails CI if any socket opens during a redaction run.

During launch — one optional request

On launch, the CLI’s web UI fetches https://anonymizer.site/version.json with a 2-second timeout to check for updates. This is the only thing the CLI requests on launch.

  • What’s sent: an HTTP GET. No User-Agent identifier beyond python-requests/<version>. No referer. No cookies.
  • What’s received: a JSON blob with the latest version string and its SHA256.

Disable it: ANONYMIZER_NO_UPDATE_CHECK=1.

During optional OCR install — package-manager traffic

Scanned PDF OCR uses a local Tesseract executable and local eng/rus language data at processing time. If you let the installer set up Tesseract, the installer may call Homebrew, apt, or winget and those package managers will contact their configured repositories. On Windows, the installer may also fetch missing eng/rus traineddata files during setup.

That network activity happens only during installation, before document processing. OCR itself runs locally and does not send scanned pages anywhere.

When you click “Update now” — once

If you accept an update in the in-UI banner, the detached anonymizer.updater runs uv tool upgrade docs-anonymizer. That command pulls the new wheel from PyPI (or your configured mirror, see Corporate setup).

This is initiated by your click — not automatic.

When you install an optional language pack — once, on your click

Russian and English models ship inside the wheel. Optional packs (Spanish, German, Italian) download their model when you install them — via the installer prompt, ANONYMIZER_LANGS, or Settings → Languages. Sources are the official model registries (GitHub releases for spaCy models, PyPI for the Russian Natasha data in the macOS app); every download is pinned by URL and SHA-256 and verified before use. Nothing about your documents is sent — it is a plain file download.

The macOS desktop app

The native app follows the same hard rule — no sockets during redaction — with its own, slightly different network list:

  • No version.json probe. The app does not call the CLI update endpoint.
  • Updates: checked via the built-in updater against https://dl.anonymizer.site/appcast.xml — manually (Check for Updates) or, if you enable the toggle, on a schedule (at most daily). Update downloads are signature-verified before install.
  • Language models: downloaded only on your explicit click in Settings → Languages, from the pinned official sources above.

When you click “Report” — never automatic

Feedback is never sent automatically. The Report dialog produces a JSON payload that you copy and share manually (Slack, email, ticket). See Reporting feedback.

What’s NOT done, ever

  • No analytics. No Google Analytics, no Plausible, no Umami, no first-party pings.
  • No crash reporting. Crashes go into ~/.anonymizer/logs/. They’re never uploaded.
  • No font/CSS hosted externally. Everything ships with the wheel.
  • No silent model downloads. Russian/English models ship in the wheel; optional language models download only when you explicitly install them (see above).

If you observe network behavior other than what’s listed above, that’s a critical bug — please report it.