Since the whole pitch is "your models stay yours," here's the actual network list. Pulled from the code, not from marketing. Put Little Snitch or a firewall on it and you'll see the same thing. With nothing configured and nothing clicked, the desktop app makes two kinds of calls:

1. License heartbeat. At launch, and hourly while a Pro license is active. It sends one field: a hardware ID. No app version, no OS, no machine name, no email. It gets a signed token back. Offline, it keeps the token it already has and decides your tier from the token's own expiry. Only an explicit revoke from the server clears it. 2. Crash reports. Sentry, packaged builds only. Stack trace, version, platform, license tier. Send-PII is off, performance tracing is off, and a scrubber strips tokens, hardware IDs, and API keys before anything leaves. There is no toggle for this yet. If that's a dealbreaker, say so here and I'll add one.