AI + privacy
You decide what AI gets to see.
AI becomes much more useful when it has context.
That makes the boundary around context the part worth explaining.
Shelf's understanding of your library runs on your Mac. One optional feature can reach an external provider, it is off until you turn it on, and it needs your own key.
01 · Order of operations
Memory first. Model second.
The parts of Shelf that make your library searchable do not call out to a model service. Text is read out of images with Apple's on-device Vision framework. Audio and video are transcribed with Apple's on-device speech recognition, and Shelf refuses to transcribe rather than let the system send audio to a server. The meaning index, search, summaries, topics and connections are built and queried on your Mac.
So Shelf's core value does not depend on your library being sent anywhere.
- Reading imagesApple's on-device Vision framework
- TranscriptionApple's on-device speech recognition, on-device required
- Meaning indexbuilt locally, from your library
- Search and connectionsrun locally, against that index
02 · The optional part
One feature, your own key.
Image variations is the one feature that uses an external AI service. It is off by default. Turning it on means providing your own OpenAI API key, which Shelf stores in the macOS Keychain. Shelf does not operate a metered AI service on your behalf.
If you never enable it, it never runs, and nothing goes to an AI provider.
On your Mac
Provider you chose
Only the context for that one request crosses the line. The rest of the library does not.
03 · What gets sent
The selected image and your request. Not your library.
For an image variation, Shelf sends the image you selected and what you asked for, under your key. Your library is not uploaded, indexed remotely, or used to train anything by Shelf.
After it leaves
Once a request reaches OpenAI it is handled under their terms and policies, not Shelf's. We cannot make promises on another company's behalf, so read theirs before turning the feature on.
04 · Not shipped
What Shelf does not do yet.
- Ask questions of your library with an external modelNot currently supported
Not a current feature, so no library-wide context is sent anywhere.
- Providers other than OpenAINot currently supported
Only the OpenAI image service is supported today.
- Local chat model bundled with ShelfNot currently supported
Shelf uses Apple's on-device frameworks and its own local index, not a bundled language model.
- Image variationsOptional external service
Off by default. Needs your own key and a connection.
Stated plainly
Current limitations
- Provider behaviour is theirs
- Anything you send to an external provider is subject to their retention and handling terms.
- The feature needs internet
- Image variations cannot work offline. Everything local carries on without a connection.
Useful AI needs context. Trustworthy AI needs boundaries.
Keep the boundary where you can see it.
Download Shelf. The optional AI feature stays off until you decide otherwise.
Free. macOS 14 and later, Apple Silicon and Intel. No account.
Keep reading
Related pages
Shelf V3 is out now
Shelf V3 is the current build. Shelf does not use automatic updates, so download the latest build here and install it over your current version.
This is intentional. Shelf is built around a local-first, privacy-focused philosophy. An automatic updater requires additional background processes, network connections, update infrastructure, and another system with permission to modify the app. We prefer to keep Shelf’s network footprint and background activity as small as possible.
Manual updates keep the process explicit: Shelf only checks the internet when a feature actually needs it, and you decide when a new version is downloaded and installed.