Bellow has no updater and no telemetry. Here's the cost of that.

19 August 2026 · 3 min read · Muteeb Mehraj

"Nothing leaves your Mac" sounds like a feature. It is also a constraint, and it removes two things that most software takes for granted.

The constraint

Bellow makes no network connections. Not for transcription, not for licensing, not for analytics, and not to check whether a newer version exists.

That is verifiable rather than asserted: the sandboxed entitlements configuration omits the network client and server entitlements entirely, so the kernel refuses outbound connections regardless of what the code attempts. You can also just turn off your network and watch the app work normally.

Once you commit to that, two familiar features become impossible.

What we lose: updates

An update check is a network request on a schedule. It usually carries your current version, your OS version, and an implicit heartbeat that says this machine is running this app right now. That is a modest amount of data, and it is not nothing.

The awkward part is that it is indistinguishable, from the outside, from the thing we tell you we never do. If Bellow opened a connection on launch, "we never phone home" would become "we phone home, but only for a good reason", and you would have no way to verify which.

So there is no updater, and updates are manual. You check the site when you feel like it and download a new build.

This is worse for you. You may run an old version for months without knowing a fix exists. That is a genuine cost and we are not going to dress it up.

What we lose: knowing anything

No telemetry means we do not know how many people use Bellow daily, which features get touched, where onboarding is abandoned, or what your most common error is.

Most product decisions are made with that data. Without it, we are working from a much thinner signal: what people tell us directly, and what we can observe on our own machines.

That has already cost us. A first-run problem, where the app appeared frozen while the speech model compiled for the Neural Engine, existed for a while before anyone reported it. On a development machine the model is always already compiled, so the slow path never runs. Telemetry would have shown a cluster of users whose first transcription never completed. Instead it took someone telling us.

Why we took the trade anyway

Because the claim only means something if it has no exceptions.

"We do not transmit your data, except analytics" requires you to trust our definition of analytics, our implementation, and our future behaviour under commercial pressure. "This app cannot open a network connection" requires you to trust an entitlement check in the kernel, which you can verify in one command.

For most software the first is a reasonable trade. For an app that listens to your microphone all day and holds a written record of everything you have said, we do not think it is.

What replaces them

For updates: the version is shown in Settings, the site says what the current one is, and release notes describe what changed. Manual, but not opaque.

For product signal: everything the app knows about your usage stays on your Mac and is shown to you. Total time, word counts, session counts, full history. That is the data telemetry would have collected, except it belongs to you and is visible in the interface. There is a one-click export of all of it in Markdown or JSON, because it is yours.

Beyond that, we rely on people telling us things. If something is broken, we find out because you say so, which is a slower and less complete channel than analytics.

It is also the one that does not require you to take our word for anything.