ObjectExplorer Your data stays here
This is the part that matters when you work with data you are not allowed to copy.
ObjectExplorer is one native program on your machine. Every reader — Parquet, SPSS, SAS, PDF, the office formats, the image and media decoders — runs on your own machine, in the app itself. Started from a terminal, it serves the app to your browser from 127.0.0.1, which nothing else on your network can reach.
- Objects are fetched from your cloud provider to your computer, and nowhere else. We run no backend that sees your data, because there is nothing for it to see.
- Credentials stay local, in the system keychain. Nothing is synced — see where your data lives.
- The calls that are not to your own storage are few, listed below, and none of them carries an object.
- Nothing is uploaded for "processing", no file names are reported anywhere, and no account is needed to open a file.
Which also means there is no data-processing agreement to negotiate before anyone can look at a bucket.
What does leave, and when
A share link, when you make one. Sharing a table is the one feature that sends rows somewhere else, and it never happens on its own: you open the dialog, decide column by column what goes — each column opening on what your PII rules already say — and copy the link. Small shares travel inside the link's fragment, which no server ever sees. A bigger one, and every read-and-burn link, is stored on objectexplorer.com until it expires.
Everything else the app asks of the outside world is listed here. None of it carries a row of your data or a path on this machine.
| Call | When |
|---|---|
| GitHub: what is the newest release? | when you open Settings → Check for Updates, and only then |
| GitHub: the new version itself | when you press Update — see updating |
| uv: a Python build, and the packages you name | when you make a Python environment or install into one |
| The web pages you added as style sources | when you add or reindex one in the writing tool |
| objectexplorer.com: your licence | at start, and in a plan's last three days, only once you have signed up |
| objectexplorer.com: the trial sign-up | when you first sign in |
| Google: signing in | when you sign in with Google |
| Google: your picture | whenever the account icon shows it, after you signed in with Google |
| Let's Encrypt: a certificate for your domain | a server started with tls=auto, at its first start and before it runs out |
There is no usage reporting and no crash reporting. What the app measures about itself — how long each file took to open, what its memory was made of — stays in ~/.objectexplorer.
What stays on this machine, and you may not expect
Your window sessions. The desktop window records each session as it happens: what you clicked, the keys you pressed, the text you typed, and the messages the app printed. It is kept so a session can be played back after something went wrong. Only the last 20 are kept, and never more than 50 MB in all, in ~/.objectexplorer/replay; nothing of it is sent anywhere. Each file is encrypted with a key kept in your system's keychain (made the first time, never shown), so what you typed cannot be read from the file, by another program or from a copy of your disk. To give a session to someone, for a bug report, oe replay export <file> <out> writes a readable copy; it holds what you typed, so look at it first. Start with record=false to record nothing — see recording a session. The browser version records nothing.
What an agent sees
An MCP client on this machine is not an exception to any of the above: it reaches storage only through this app, only at 127.0.0.1, only in the roots you ticked, and only with PII already rewritten — by the same PII rules a share link goes through. It never holds a credential, and every call it made is on your disk in ~/.objectexplorer/mcp/. The door is shut until you open it — see ObjectExplorer for agents.
What a cloud provider sees
The same thing it would see if you used its own console: signed requests from your machine, for the objects you opened. ObjectExplorer adds no proxy, no relay and no third party in between.
Who is responsible
Knock Data AB (organization number 559229-1867), Sweden, is the controller for the data described on this page — see company. This website sets no tracking cookies and runs no analytics. The server keeps an ordinary access log (address, time, page) for security, and a trial sign-up keeps the email you gave, encrypted. Ask rockie@knockdata.com to see or delete what we hold about you.
Next: connecting storage.