Trust

Do not believe us. Watch.

A dishonest app would make the same claims this site makes, in the same words. So here is the procedure that would catch us if we were lying: watch every connection Bolt opens, on your own machine, with tools we do not control.

Three ways to check, in increasing order of paranoia

Our script, which you should read first

Samples the real sockets held by Bolt's own processes, names each remote address, and classifies it against our published list. Roughly 180 lines of shell, deliberately short enough to read in a couple of minutes.

Your own tools, if you would rather not run ours

Little Snitch or LuLu on macOS, Resource Monitor on Windows, ss or tcpdump on Linux. Any of them shows the same thing. We would rather you used a tool we did not write.

The blunt test: turn off the network

Disconnect from the internet and keep using Bolt. Search, clipboard history, notes, OCR, file search, the identifier validators, the whole local surface keeps working, because it never needed a server.

Run the script

Download it, read it, then run it. We are not going to publish a page about not trusting us and then ask you to pipe our script straight into a shell.

macOS and Linux

curl -fsSLO https://sparcle.app/scripts/bolt-network-check.sh less bolt-network-check.sh # read it first sh bolt-network-check.sh -d 300 # then watch Bolt for five minutes

Windows

curl.exe -fsSLO https://sparcle.app/scripts/bolt-network-check.ps1 notepad bolt-network-check.ps1 powershell -ExecutionPolicy Bypass -File bolt-network-check.ps1 -Duration 300

Both scripts are served as plain text, so you can read the shell one or the PowerShell one in your browser first, without downloading anything. It is read-only. It changes nothing, installs nothing, and uploads nothing. The only network traffic it can generate is a reverse-DNS lookup to put a name on each address it finds, and --no-dns turns even that off. Use Bolt normally while it runs. The more you do, the more the test is worth.

What the output looks like

This is a real run against a machine with a Google account connected, trimmed for width. The Google connections are the point: that is mail syncing directly from the machine to Google, with no Sparcle server anywhere in the path.

=== Connections that left this machine === bolt-api 2001:4860:4841:400:: Google address block, direct from your machine. Present only if you connected a Google account. === What stayed on this machine === Bolt runs its own services on loopback. This is where your data actually is. bolt 127.0.0.1:13017 the app shell's local bridge bolt 127.0.0.1:13018 the local Bolt API. Every request the app makes goes here bolt 127.0.0.1:13020 the local clipboard and hotkey bridge bolt-api 127.0.0.1:15499 the Postgres database Bolt runs for you, loopback only bolt-api 127.0.0.1:6379 the local cache postgres 127.0.0.1:15499 the Postgres database Bolt runs for you, loopback only 36 loopback sockets seen in total. None of them can leave this machine.

What you should expect to see, and why

Nothing, if you have connected nothing
On a machine with no integrations connected, the honest result is an empty list. Bolt does not check in with us, does not validate a licence over the network, and sends no usage telemetry. The one thing that can leave on its own is an update check, and that goes to GitHub.
Google or Microsoft, if you connected an account
You will see connections to Google or Microsoft address blocks, from Bolt directly. That is your mail and calendar syncing to the provider you connected, machine to provider. It does not pass through Sparcle, because there is no Sparcle server in that path to pass through.
Your LLM endpoint, if you configured one and used it
Bolt ships no model and no default endpoint. Whatever appears here is the provider you chose, and structured PII and secrets are masked before the call leaves.
A lot of loopback traffic, which is the point
Bolt runs its own API and its own Postgres database on 127.0.0.1. Most of what the script prints is the app talking to itself on your machine. That is where your data is.

What this method cannot tell you

A page like this is only worth reading if it also says where the method stops.

It shows destinations, not contents

You can see that Bolt talked to Google. You cannot see what it said, because the connection is encrypted. If you want the contents too, run Bolt behind a TLS-inspecting proxy on a test machine and read the requests. We would rather you did that than take our summary of them.

It is a sample, not a proof of a negative

Watching for five minutes proves what happened in those five minutes. It does not prove what happens on a date we chose in advance. That is what source-level review and reproducible builds are for, and we are honest on the supply chain page about how far along those are.

It watches Bolt, not your whole machine

The script deliberately looks only at Bolt's own processes, so the result is not diluted by everything else you are running. A full-machine monitor like Little Snitch is the stronger test, and we would rather you used one.

It cannot tell you what we do with data you send us

There is nothing to tell, because there is nowhere to send it. That is the claim this page exists to let you check rather than accept.

Found something we did not disclose?

That is a real finding and we want it. Our vulnerability disclosure policy commits to a one-business-day acknowledgement and a good-faith safe harbor.

Email [email protected] The published list