Private by architecture

There is no account to breach, because there is no account.

The AI that reads and understands your paperwork lives on your Mac, and your documents never leave it. The only thing ShabuBox sends is anonymous usage statistics you can switch off. Here’s exactly how that works.

The claim

Genuinely private

Not a policy choice you have to trust — a design where your documents can’t leave, because nothing is built to send them.

The mechanism

On-device models

OCR, document understanding, entity extraction, and chat all run locally, inside Apple’s App Sandbox.

The verification

Check it yourself

Pull the network cable and the app still works. There’s no account anywhere to hold your data, and the one thing that is sent is written down in full below.

The stack

Every model runs on your Mac.

Apple Foundation Models

Apple Intelligence powers the first tier of on-device chat generation.

Apple Vision OCR

The same framework as Live Text reads every page — no cloud OCR.

MLX local models

Open models run via MLX, 4-bit quantized, gated to what your Mac’s RAM can handle.

GLiNER2 NER

Entity extraction — people, organizations, places, addresses — runs entirely on-device.

What crosses the network

Three things go over the network. None of them is your data.

One-time model download

If you opt into a richer local chat model, it downloads once from the HuggingFace CDN. No document data is ever transmitted.

Local scanner discovery

To find AirScan scanners, ShabuBox looks on your local network. That traffic never leaves your home or office.

Anonymous usage statistics

Which features get used and how often, plus your app and macOS version — sent to our own service, tied to a random install ID that is hashed before it leaves your Mac, so we can debug problems and improve the app. Never your documents, file names, or anything you typed. Off with one switch in Settings › General › Privacy. The library behind it, swift-stats, is open source and ours — built privacy-first so we never had to ship anyone else’s tracker.

Everything else

No third-party analytics or advertising SDKs. No crash-reporting SDKs. No account sync. No stored IP addresses, no location, no ad identifiers.

How to verify it yourself

Turn off Wi-Fi and Ethernet — import, OCR, understand, file, and search still work.

Read the app’s privacy manifest, or the one file that lists every usage event it can emit — the list is closed, and none of it can carry your text.

There is no sign-up screen and no account settings, because there is no account.

Your files stay as ordinary files in ordinary folders you can inspect in Finder.

What we declare

"Not linked to you"

ShabuBox’s privacy manifest declares exactly two collected types — product interaction and diagnostic data — both marked not linked to your identity and not used for tracking. There is no user ID, because the app never asks for one.

Looking for the formal document? Read the Privacy Policy.