What leaves your Mac, and when.

Last updated 23 September 2026. Applies to Seedbed for macOS and to the Python package and local web page in the same repository.

What Seedbed stores, and where

• Your library is plain markdown in a git checkout at the default location or one you chose. Seeds, rendered prompts and the model registry are all files you can read, diff and delete. Seedbed never copies them anywhere else.
• Copy counts and the values you type into placeholders stay on the machine that typed them. Both files are excluded from the repository on purpose, so a project name you filled in on one Mac is not pushed to another.
• Fetched vendor guidance is cached on disk and also kept out of the repository, because it is a download rather than something you own.
• Settings live in the app's own preferences. The tokens for the local agent server live in your login Keychain, not in a file.

What leaves your Mac

First launch may download the public library. The other network actions follow a command or setting you choose.

1. Creating the library

If no valid library exists on first launch, Seedbed clones the public repository from GitHub. GitHub receives an ordinary download request, not your prompts. An existing library is used without this request.

2. Fetching a model's prompting guidance

When you refresh guidance, Seedbed downloads the vendor documentation pages listed in the model registry, from those vendors. Your prompts are not part of that request. It is an ordinary page fetch, and you can point a model at a local file instead.

3. Building a rendered prompt

Building sends the seed, the cached guidance and an instruction to whichever enhancer you configured. That destination is your choice, and it is the only place a prompt of yours is sent:

• By default, the claude command-line tool already installed on your Mac, under whatever subscription you already have. Seedbed adds no key and no account.
• An Anthropic API key, if you configure one.
• Any OpenAI-compatible endpoint, including one running on your own machine or network, in which case nothing leaves your network at all.

Copying a prompt sends nothing. The render is already a file, so copying is a file read and works offline.

4. Checking for updates

A copy installed from the disk image asks seedbed.dev for the signed update feed, the way any Sparkle-based Mac app does. That request carries no identifier for you. A copy built from source in a checkout checks the git repository instead and never contacts the site.

5. Crash reports, if you turn them on

Off by default, and behind two gates that both have to be open. You have to switch reporting on, and the build has to carry a reporting key that is injected at packaging time and never committed. A copy you compile from the public source has no key, so it cannot report anything however the switch is set.

When it is on, a report carries the stack trace, the app and system versions, and nothing else that identifies you. The reporting library is told not to attach your IP address or any user identifier, the machine name is cleared from every event, and any long run of hexadecimal, which is the shape an access token takes, is replaced before sending.

Prompt text is never captured. That is a design decision before it is a filter: nothing in the app hands library content to the reporter. Errors from the Python core can quote a prompt, so they are shown to you in the window and deliberately not reported. A single launch may send at most twenty events, so a fault that repeats cannot turn into a flood.

Turning reports on means Seedbed will try to send a report after a crash, and it does not confirm that the report arrived.

The agent server is local, and stays local

Seedbed can expose your library to an AI coding tool through a small server. It listens only on the loopback interface, so nothing on your network can reach it, and every request must also carry a bearer token held in your login Keychain. Both, not either. A second read-only token can look prompts up but can never spend a model call. Ten wrong tokens start a lockout that doubles up to fifteen minutes, and a request that claims to come from another site is refused. There is no remote access switch and no tunnel.

Permissions the app asks for

• Accessibility, and only to press Command-V in the app you summoned Seedbed over, which is exactly the capability that permission governs. Decline it and Seedbed copies to the clipboard and tells you why it did not paste.
• The clipboard, to put the prompt you asked for on it.

Seedbed asks for nothing else: no contacts, no calendar, no camera, no microphone, no location, no full-disk access.

What Seedbed never does

• No accounts and no sign-in. There is nothing to sign in to.
• No analytics, no usage tracking, no advertising and no ad identifiers.
• No selling, renting or sharing of data. There is no data held to sell.
• No uploading of your prompts anywhere except the enhancer you chose.
• No background network activity. Nothing runs when you are not using it.

Children

Seedbed is a developer tool and is not directed at children. It collects nothing from anyone, so it holds nothing about a child either.

Changes, and how to check any of this

If a future version sends something new, it will ship switched off, this page will say where the data goes, and the switch will be yours. The date at the top moves when the page does.

Seedbed is open source under the MIT licence, so the code is the authority rather than this page. The crash-report scrubbing, the two gates on reporting, the loopback binding and the token checks are all in the published repository, and the questions this page answers can be checked against it.

Questions, or something here that does not match what you observe: open an issue on GitHub.

Back to seedbed.dev