Local-first. No telemetry.
OpenFrame has no account, no server of ours and no analytics. Your footage, your projects and your exports stay on your computer. Here is everything the app connects to, and how we checked.
The app
What it never does
- It does not upload your media, projects or exports anywhere.
- It has no account, sign-in or license server.
- It contains no analytics, telemetry, crash reporting or advertising code.
What it connects to, and when
- Hugging Face, once per model. The AI features that need a model download it the first time you use them, then work offline:
| Feature | Model | Download |
|---|---|---|
| Auto captions, filler words, edit by transcript | Whisper (tiny, base or small, by your choice) | 41 to 249 MB |
| Text to speech and voiceover | Kokoro-82M | about 325 MB at Best quality (the default), 92 MB at Draft |
| Remove background, text behind the subject | ormbg on a GPU with WebGPU; MediaPipe Selfie otherwise | 88 MB, or 0.5 MB |
- A model server on your own computer, for the AI assistant: Ollama (127.0.0.1:11434) or LM Studio (127.0.0.1:1234), if you run one. The desktop app reaches only those two local addresses for it.
- Your browser, when you click a link, such as the install guide for Claude Code or Codex when the app cannot find them.
- Nothing else on its own. The desktop app's content security policy allows network connections only to the app itself and to Hugging Face. Manual editing and export work fully offline.
Where your work lives
- Desktop: projects are JSON files in the app's data folder, with the previous version kept as a backup. Your media stays where it is on disk; projects refer to it by path.
- Web build: projects and imported media live in your browser's private storage for that site, on your device. Clearing site data removes them.
- Exports go where you choose; an agent's exports go to your Videos folder.
AI agents
The MCP server for agents is off until you turn on Allow AI agents. It listens only on 127.0.0.1, refuses requests from other websites, and needs the token made for your install. An agent that connects runs on your computer with your permission; what that agent sends to its own provider is between you and that provider, as with any other use of it. More on the safety model.
How we checked
On October 18, 2026, at revision 757159b, we searched the app's source and dependency lists for analytics,
telemetry and crash-reporting code (there is none), listed every network address in the TypeScript and Rust source,
read the desktop app's content security policy, and confirmed the Rust side has no HTTP client beyond its own local
servers. This is a review of the code, not a network audit of a release; it will be repeated for the first packaged
release, and the release checklist tracks it.