Handoff Download

Network: what leaves the computer

Handoff records screens, clicks and notes, so it is fair to ask where they go. The short answer: nowhere. Recordings, notes, guides and the prompts that write them stay on the computer. Handoff connects to the internet only to download a model file the person asked for, and with Offline mode on (Settings → Network) not even that.

Every connection Handoff makes

To When What is sent
Ollama on this computer (http://127.0.0.1:11434) Writing a guide, listing or downloading models, the problem report’s model line Screen text, steps and notes, to the local model. Never leaves the computer.
ocrs-models.s3-accelerate.amazonaws.com Settings or Guide → Install text recognition A request for two model files (about 30 MB). Nothing about the person or their work.
huggingface.co, then its CDN under hf.co Settings → Voice notes → Download the Whisper model A request for one model file (about 150 MB).

That is the complete list. Some things that might look like network use, and are not Handoff’s:

  • Model downloads in Ollama. Settings → Local model → Download asks Ollama to fetch a model; Ollama downloads it from ollama.com. Handoff sends Ollama only the model’s name. Not done in Offline mode.
  • Problem reports open an email in the person’s own mail app; nothing is sent until they press Send there.
  • Apple’s speech recogniser is used on-device only (requiresOnDeviceRecognition).
  • Apple’s on-device model (macOS 26 and later) runs inside macOS on this Mac through the FoundationModels framework, which has no network fallback: prompts never leave the computer. The model itself is installed and updated by macOS with Apple Intelligence, not by Handoff.
  • The video encoder (ffmpeg, bundled for the video overview) is built without any network protocol (--disable-network, only the file and pipe protocols; scripts/build-ffmpeg.sh), so it cannot connect anywhere. Handoff starts it with fixed arguments and hands it frames.
  • Ollama itself is a separate program with its own behaviour, such as checking for updates. Generating text with a local model does not use the network.

How this is enforced

  1. One gateway. Every HTTP request goes through crates/analyze/src/net.rs, which has two kinds of client: one for Ollama that refuses any address not on this computer (no proxy, no redirects), and one for downloads that refuses any host but the three above (redirects included) and refuses everything in Offline mode. A unit test (no_http_client_is_made_anywhere_else) fails the build if an HTTP client, socket or other network library is used anywhere else in the code.
  2. No cloud models. Ollama can also run "cloud" models on ollama.com, which would send the prompt there. Handoff does not list them (remote_host in Ollama’s model list, or a cloud tag) and refuses to send a prompt to one.
  3. A locked-down window. The interface runs under a content security policy that allows its own files, screenshots from the data folder and calls into the app, and no other connection, script, frame or form (src-tauri/tauri.conf.json).
  4. Checked in testing. scripts/mac-e2e.sh samples every connection the Handoff process holds, four times a second, from start to finish of two recordings, writing the guide and exporting it. It fails if Handoff connects anywhere off the computer except while installing text recognition, which the test asks for. Ollama’s connections are logged for information. Sampling can miss a connection shorter than a quarter of a second; the gateway above is the guarantee, the test checks it holds in the built app.

Checking it yourself

  • An outbound firewall shows every connection an app makes and can block them: LuLu (free) or Little Snitch on a Mac, the built-in firewall or a tool like simplewall on Windows, OpenSnitch on Linux. Allow Handoff nothing and everything except model downloads keeps working.
  • On a Mac, without installing anything: while Handoff is open, run nettop -p $(pgrep -f Handoff.app/Contents/MacOS/handoff) in Terminal and use it.
  • Organisations can block Handoff’s outbound traffic entirely at the firewall or through device management, and install the model files with Offline mode on: copy text-detection.onnx and text-recognition.onnx (and ggml-base.bin for Whisper) into the models folder of the data folder (Settings → Storage shows where it is).

What would make this a formal assurance

There is no certification for "this desktop app sends nothing": SOC 2 and ISO 27001 certify organisations and services, not a program on a computer, and macOS’s App Sandbox, which could block the network at the system level, also blocks the accessibility and input features Handoff needs. The usual route is an independent review: a security firm reads the code (above all net.rs), tests the built app with its network watched, and writes a report. For that report to cover what people install, releases should be built from the reviewed source and signed and notarised, so the installed app can be traced to it.