Is Ollama private? What stays on your machine, and what reaches ollama.com

The Morse teamPublished November 5, 20268 min read

As of November 2026, Ollama is private when the model runs on your own computer: its FAQ says "We don't see your prompts or data when you run locally" (Ollama), and the local server listens only on your machine unless you change it. Three things do leave: anything you send to a :cloud model or to web search, the model files you pull, and an hourly update check from the macOS and Windows app, which no setting turns off.

We read Ollama's privacy policy, FAQ, cloud, web search, and authentication docs, its pricing page and blog, its GitHub repository's source code, and the National Vulnerability Database's entries for Ollama, all on November 5, 2026. Ollama deserves credit here. Its code is MIT-licensed, so we could check its claims line by line, it publishes where its cloud runs, and one switch turns the cloud off.

Ollama privacy at a glance

Read on November 5, 2026, from Ollama's own pages and code. The latest release then was v0.40.14, published November 3 (GitHub).

Does Ollama send your prompts anywhere?

Not when the model is local. Ollama's privacy policy, last updated in March 2026, says "We do not collect, store, transmit, or have access to your prompts, responses, model interactions, or other content you process locally" (Ollama).

The same policy says Ollama "may collect limited device and usage metadata (such as app version and request counts)," and lists "Model download metadata" among the data it gathers automatically (Ollama). Ollama keeps that metadata "as needed for service operations, security, and improvement, then deleted or de-identified," with no period given.

Pulling a model always uses the network. The FAQ says "Ollama pulls models from the Internet" and only over HTTPS (Ollama). The model name and your IP address reach the registry, but nothing you type does.

Does the Ollama app phone home?

Yes, once an hour, and it can't be switched off from Settings. We read the desktop app's updater in Ollama's GitHub repository. It is built only for macOS and Windows, starts three seconds after launch, and checks https://ollama.com/api/update every 60 minutes (GitHub).

Each check sends your operating system, your CPU architecture, your Ollama version, and a timestamp. On a Mac it also sends the random device ID the app created when you first installed it (GitHub). The request is signed with the key Ollama keeps in ~/.ollama/id_ed25519 (GitHub).

The app's Settings have a switch called Auto-download updates, on by default. Turning it off changes what happens after the check: a code comment says "Always check for updates," and with the switch off the updater logs the new version and skips the download (GitHub). The updater doesn't read the Cloud switch either. To stop the check itself, block ollama.com in your firewall, or run Ollama from the command line on Linux, where this updater isn't built.

None of this carries your chats. Those stay in db.sqlite, under ~/Library/Application Support/Ollama on a Mac or %LOCALAPPDATA%\Ollama on Windows (GitHub), and Ollama's docs don't describe encrypting that file. Logs go to ~/.ollama/logs on a Mac (Ollama).

Are Ollama's cloud models private?

Private from other people, and Ollama promises to keep nothing, but your prompt leaves your computer as text a server has to read. Ollama launched cloud models in preview on September 19, 2025, so you could run large models "with fast, datacenter-grade hardware," starting with deepseek-v3.1:671b-cloud and qwen3-coder:480b-cloud (Ollama). You run one like a local model, after ollama signin.

Ollama describes what happens to those prompts in four places, and the wording differs:

• The FAQ, answering whether prompts go back to ollama.com, says cloud prompts are handled only "to provide the service" and that Ollama does not "store or log that content" (Ollama).
• The privacy policy says Ollama processes them "transiently to provide the service and never train on it," and names "model inference providers" among the third parties that help it operate (Ollama).
• The pricing page says "Ollama collaborates with NVIDIA Cloud Providers (NCPs) to host open models," and that "we require no logging, no training, and zero data retention policies in place" (Ollama).
• An August 31, 2026 post says "Every request runs on dedicated compute in the US and Europe with zero data retention" (Ollama).

Put together, a cloud prompt may be processed by a partner company, not by Ollama itself, under a contract Ollama says forbids keeping it. Models run "primarily in the United States," and Ollama says "we may route to Europe for additional capacity" (Ollama). The address ollama.com/turbo, from Ollama's earlier hosted service, now shows the same pricing page.

Web search goes through Ollama too. The docs say "A free Ollama account is required," and each search is a request to https://ollama.com/api/web_search (Ollama). Neither that page nor the September 24, 2025 launch post makes any statement about keeping searches, and neither names the search provider (Ollama).

What stays local and what goes over the network

Our table of every Ollama feature we found, built from the sources above on November 5, 2026.

How do you turn off Ollama's cloud features?

In the desktop app, open Settings and turn off Cloud, the switch labelled "Enable cloud models and web search" (GitHub). Then run ollama signout, so your install stops carrying an Ollama account (Ollama). Local models keep working; cloud models and web search go away.

The app can't override a server-side setting. When the environment variable is set, the switch greys out and reads "The OLLAMA_NO_CLOUD environment variable is currently forcing cloud off." On a server without the app, use the FAQ's variable or server.json key and its log line, which our local AI vs cloud AI guide lists (Ollama).

Is Ollama safe to run on your network?

Yes on the defaults, if you keep it updated. The FAQ says "Ollama binds 127.0.0.1 port 11434 by default," and you change that with OLLAMA_HOST (Ollama). Ollama's authentication docs say "The local API at http://localhost:11434 does not require authentication" (Ollama), so anyone who can reach the port can use it. The app's Expose Ollama to the network switch, off by default, sets OLLAMA_HOST to 0.0.0.0, every network interface (GitHub).

The flaws recorded so far show what an open port risks:

• CVE-2026-7482, published May 4, 2026 and rated 9.1, critical. Before version 0.17.1, a crafted model file could make the server read past its memory buffer, and the leaked memory "may include environment variables, API keys, system prompts, and concurrent users' conversation data." The entry adds that OLLAMA_HOST=0.0.0.0 is "widely used in practice (large public-internet exposure observed)" (NVD).
• CVE-2024-37032, published May 31, 2024 and rated 8.8, high. Versions before 0.1.34 didn't check the format of a model's digest, which allowed paths starting with ../ (NVD).
• CVE-2024-28224, published April 8, 2024 and rated 6.6, medium. Before 0.1.29, a DNS rebinding flaw could "inadvertently allow remote access to the full API," so "an unauthorized user" could "chat with a large language model, delete a model, or cause a denial of service" (NVD).

These are recorded in the National Vulnerability Database, not in the repository. As of November 5, 2026, the security tab of ollama/ollama on GitHub says "There aren't any published security advisories" (GitHub), so an empty tab doesn't mean nothing was found. The FAQ also says Ollama accepts cross-origin requests from 127.0.0.1 and 0.0.0.0 by default, widened with OLLAMA_ORIGINS (Ollama); leave that alone unless a tool you trust needs it. Our local AI vs cloud AI guide covers how many Ollama servers turn up open on the internet.

How Morse runs big open models when your GPU can't

A :cloud tag is there for models like DeepSeek V3.1, at 671 billion parameters, that no laptop holds. Pick one and your prompt lands in a datacenter as plain text the model has to read, and from there you have Ollama's wording to go on: "transiently" in the policy, "never logged" on the pricing page, and partner hosts you didn't pick. Morse also runs big open-weight models in the cloud, without a GPU of yours, but it can send them your prompt sealed.

• E2EE, for what you'd have typed into a :cloud model. GLM, Kimi, and DeepSeek run in secure enclaves. Your browser verifies the enclave's hardware attestation first, then encrypts the prompt so that enclave alone can open it; our servers carry ciphertext and the reply is decrypted in your browser. Third-party providers run the enclaves, not Morse, and the protection holds as long as the enclave hardware and attestation work as designed. E2EE models can't search the web, so keep searches for the next mode.
• Private, the default, for questions that need a search. Open-weight models and xAI's Grok, with zero data retention agreements between Morse and its inference, search, and other providers. Where a provider confirms zero retention on each reply, Morse checks it and refuses a reply that doesn't.
• Anonymous, for the GPT, Claude, and Gemini models Ollama can't pull. The provider sees the message without knowing it's you, and may keep it for a limited time to check for abuse, under its own policy.

Instead of a db.sqlite file, your Morse history stays in your browser, encrypted; our privacy policy sets out what we hold and what we don't. Our guide to end-to-end encrypted AI chat explains the enclave check step by step.

Like a local Ollama model, Morse needs no account to try: send a message from the Morse home page, or start free with no card. E2EE chats come with Pro, at $19 a month.