Which productivity tools do not collect your data?

15 September 2026

Almost every productivity tool now describes itself as privacy-first. The phrase is unregulated and means nothing on its own, so the useful skill is checking rather than believing. Here are the tools that hold up, and how to test any other.

The tools that genuinely keep your content on your machine are, for the most part, the ones that store files rather than rows in somebody's database. Obsidian keeps notes as Markdown files in a folder you own. Logseq does the same and is open source. Standard Notes and Joplin are end-to-end encrypted, so the server holds your notes but cannot read them.

For capture, the operating system tools do their recognition locally, as does Second Read, which runs text recognition inside your browser and never uploads the image. For passwords, Bitwarden and KeePassXC. For browsing, uBlock Origin. For email, Proton and Fastmail differ in model but both sell the product rather than the user.

The common thread is that each of these has a business model that does not require your content. That is a more reliable signal than any privacy policy.

What does local-first or on-device actually mean?

Local-first means the authoritative copy of your data lives on your device, and any server involved is a convenience for syncing rather than the place your work lives. On-device means a particular piece of processing happens on your machine rather than on a server.

Neither term is protected, and both get used loosely. A tool can accurately say processing is on-device while still uploading the result, and a tool can call itself local-first while requiring an account and storing everything in the cloud.

The question worth asking is specific: which exact thing stays local? For a capture tool, the answer that matters is whether the image is uploaded to be read. For a note tool, it is whether your notes are readable by the company holding them.

How do you check whether a tool is really private?

Three checks, none of which need technical skill. First, turn off your network and use the feature. If it still works, that processing is genuinely local.

Second, read the permissions rather than the marketing. For a Chrome extension, chrome://extensions shows exactly what it can reach, and "read and change all your data on all websites" means what it says regardless of what the listing promised. Chrome Web Store listings also carry a declared data-collection section, and a false declaration is grounds for removal, which makes it more accountable than a policy page.

Third, look for what the company sells. A free tool with investors and no paid tier will eventually need revenue, and your data is the asset it already has. That is not a reason to avoid free software, but it is a reason to prefer free software that is either open source or cheap to run.

Are there offline productivity tools that still sync?

Yes, and this is the combination most people actually want. Obsidian works entirely offline and offers end-to-end encrypted sync as a paid extra, or you can sync the folder yourself with anything. Standard Notes and Joplin sync through a server that cannot read what it is storing. Bitwarden does the same for passwords.

The design that makes this possible is encrypting on your device before anything is sent, so the server stores a blob it cannot open. It is well-established technology and the reason it is not universal is that it makes features like server-side search and web previews much harder to build.

Second Read sits in between and is worth being exact about: the recognition and the image never leave your machine, while the resulting text is stored in a database so it can reach your other devices and your digests. The text is protected by row-level access rules rather than by encryption you hold the key to, so it is honest to say the capture is private rather than that the storage is unreadable.

Is a privacy-first Chrome extension possible at all?

Yes, and the permission system is what makes it checkable. An extension can only do what it has asked for, Chrome shows you the list before you install, and adding a permission later forces a fresh prompt and disables the extension until you accept.

The permissions that matter are the broad ones. Access to all sites, browsing history, and most frequently visited websites are the three that turn an extension into a surveillance tool, and plenty of extensions request them for features that do not need them.

A well-scoped extension asks for access to the page only when you invoke it, requests specific hosts rather than all of them, and explains each one. Second Read, as an example of the pattern rather than a claim to be unique, requests the Amazon notebook page only if you connect Kindle, and asks for no history and no site list at all.