The month every Claude-powered Mac app had to stop saying "nothing leaves your device"

The surface story is the one every roundup runs: Opus 4.7 reached general availability at the same $5 / $25 per MTok pricing as 4.6, Claude Code got a redesigned desktop app and the Routines research preview on April 14, Bloomberg reported on April 16 that Anthropic held back a model called Mythos after internal red-team results and began a controlled Project Glasswing rollout to roughly 40 enterprises including Amazon, Apple, Microsoft and JPMorgan Chase, new funding offers valued the company near $800 billion, a multi-year Google Cloud / TPU expansion and a Broadcom multi-gigawatt deal both landed, and the Long-Term Benefit Trust appointed Vas Narasimhan to the board. The quieter story, and the one this page is about, is what all that shipping forced every consumer app built on the Claude API to rewrite in its own user-facing copy.

Because two things cannot both be true. A consumer Mac app that sends every assistant message to api.anthropic.com cannot also tell a first-run user 'nothing leaves your device.' It was survivable as marketing shorthand while Anthropic was quiet. It was not survivable the month Anthropic was in the news every 48 hours about new user-visible API policy. The honest word for that architecture is 'local-first', not 'local-only', and April 2026 is the month the gap between those two words became too visible to paper over.

Four specific strings in Desktop/Sources/Chat/ChatPrompts.swift, across three commits all pushed on 2026-04-15. Commit e3666089 (15:13:12 PDT) rewrote the browser-profile migration prompt around line 134 from 'Nothing leaves the device' to 'The extracted profile stays on the device.' Commit f1d07e72 (15:14:14 PDT) rewrote three onboarding strings in the same file: the PRIVACY & DATA block at line 173 ('nothing leaves the device unless they opt in' -> 'AI queries are sent to Claude's API for processing but are not stored or used for training'), STEP 0 SAFETY at line 216 ('Everything runs locally and I'm fully open-source, your data never leaves your machine' -> 'I'm fully open-source and local-first, your data is stored on your machine, and AI queries aren't stored or trained on'), and STEP 5 PRIVACY NOTE at line 293 ('your data stays on your machine, you own it all' -> 'your data is stored locally and you own it all'). Commit 5196e220 (15:14:39 PDT) added the one-line CHANGELOG entry. All three landed in v2.3.2, released 2026-04-16.

Yes. The distinction that matters is the word 'first' vs the word 'only.' Memories, files, conversations, the knowledge graph, the browser profile extract, the skill library at ~/.claude/skills, the ACP bridge's JSON line subprocess, every observer thread and every scheduled task all run on the user's machine. AI inference is the remote piece: each assistant message is sent to Anthropic's API for model generation. That is the one outbound hop. Anthropic's own API policy states those calls are not stored for training. The April 2026 copy change is about stating that architecture accurately in the moment a new user is deciding whether to grant permissions, not about changing the architecture itself.

Four of them, stacked over a two-week window. (1) The April 7 rollout of the ACP v0.25.0 error handling for credit exhaustion and rate limits, because telling a user 'nothing leaves your device' and then showing them a credit-exhausted error is a self-contradiction. (2) The April 11 addition of a 'custom API endpoint' setting for proxies and corporate gateways (Fazm v2.2.0), which literally exists to let admins route assistant traffic through their own infrastructure. (3) The April 14 Claude Code desktop redesign and Routines preview, which put Anthropic's own assistant app in the news as a thing that talks to their API. (4) The April 16 Bloomberg piece on Mythos and Project Glasswing, which made clear that what model you get and whether you get one at all is an Anthropic-side decision, not a local-side one.

Local-first means the canonical copy of your data lives on your machine and the app can still be useful when it is the only copy. Private is a claim about who can read a remote copy. They overlap but are not the same. Fazm is local-first in the first sense (all data is stored on-device, and cross-device sync is encrypted so only the user can read it) and relies on Anthropic's API privacy terms for the remote inference hop (queries are not stored for training per Anthropic's stated policy). Before April 15, Fazm's onboarding conflated the two by saying 'nothing leaves your device.' After April 15, it separates them: 'your data is stored on your machine, and AI queries aren't stored or trained on.' Two clauses, each narrowly true.

Yes. The repository is public at github.com/mediar-ai/fazm. The three relevant commit SHAs are e3666089 (2026-04-15 15:13:12 PDT, 'Update privacy copy in browser profile migration prompt'), f1d07e72 (2026-04-15 15:14:14 PDT, 'Update chat prompts to clarify Claude API usage and data privacy'), and 5196e220 (2026-04-15 15:14:39 PDT, 'Add changelog entry for local-first privacy language update'). All three touch Desktop/Sources/Chat/ChatPrompts.swift except 5196e220 which only touches CHANGELOG.json. The user-facing release is v2.3.2 dated 2026-04-16 in CHANGELOG.json. Run 'git show f1d07e72 -- Desktop/Sources/Chat/ChatPrompts.swift' to see the diff. The changed line numbers are 134, 173, 216, and 293 in the post-commit file.

It applies broadly. Any Mac assistant that routes queries to a hosted LLM API (Anthropic, OpenAI, Google, anyone) faces the same copy problem. Most apps handled it by never making the claim. Fazm had made the claim and corrected it in public, which is why the commit diff exists and is citable. The broader lesson is not about Fazm; it is about the difference between 'local-first' as an architecture pattern and 'nothing leaves your device' as a marketing line, and the importance of saying which one you actually have.