Models & data boundaries
A sovereign AI assistant on Mac and iPhone: what stays local, and what does not
An honest map of JoeBro’s local Mac workspace, model-provider boundary, iPhone pairing requirements, and the limits of its documented setup.
Native macOS AI workspace
AI that’s actually yours
JoeBro is a local-first AI workspace for your Mac, with an iPhone companion that talks to it directly. Bring your own models, and keep your chats, documents and memory on your machine.
v1.3.0 · macOS 26 or later on Apple Silicon · Free and open source (GPLv3)
Your Mac, your iPhone, your Pi, your memory, your model, your tools. No cloud in the middle.
01 · appNative SwiftUIA real Mac app. No Electron.
02 · backendZero dependenciesA Python standard-library backend, bundled inside.
03 · modelsYour modelsOllama locally, or your own API key.
04 · accountNo accountNothing to sign up for. Nothing to install.
Features
One window, not ten apps.
Write together
Chat with any model, with streaming, extended thinking and a real agent mode. Documents open right beside the conversation, including real Word .doc and .docx files, edited in place. Deep Research reads many sources and writes a cited report.
It remembers you
Brain is long-term memory filed on topic pages. Only what is relevant to the message at hand reaches the model. Add, edit, search or delete any memory, or explore it as a live brain map. Phone memory is plain Markdown you can open and edit.
Bring your own tools
Hand the agent any JSON endpoint as an API tool, add MCP servers over stdio, or drop in plugins. No MCP server is ever added for you, and the phone cannot add one either.
Blank slate. Your canvas
An adaptive glass interface over any wallpaper you choose, with built-in colour accents. Pick a swatch on the window: it re-themes the screenshot and this whole page.
JoeBro Mobile
Your agent, in your pocket
One chat that follows you, running on your own Mac. No cloud in the middle. Tasks run quietly in the background and only ping you when something changed. It is a source release: you build it yourself with Xcode.
Phone agent
One chat that follows you
It runs on your own Mac and pings you when something needs you.
Any news from Rui?He pushed the schedule page. Want me to reply?
Pairing
Scan once. Done
Scan the QR code on your Mac and you are in. No account, no cloud.
Memory
Notes it can read
Plain Markdown files you can open and edit, on the phone or the Mac.
# about-me - Freelance designer - Prefers short answers
Inbox
Pings, not noise
Every notice lands in one inbox. Select all and clear it in one go.
Invoice overdueWant me to draft a nudge?Morning briefingTwo meetings todayRain tomorrowTake the jacket
Runs where you are
Your Mac. Or your Pi
The backend ships inside the Mac app and starts with it. That is the documented setup. I run mine headless on a Raspberry Pi so it stays reachable without leaving a Mac awake; that is my personal arrangement, not a supported installer.
Privacy & sovereignty
AI is better when it knows you. So keep it close
What you type · on your Mac
Book the Lisbon flights on my card 4929 1234 5678 9012, the airline password is hunter2-lisboa, and use my API key sk-proj-7Hf2kQa9Lx for the price check.
Cloak Mode
What the model receives
Book the Lisbon flights on my card 4929 1234 5678 9012[CARD NUMBER], the airline password is hunter2-lisboa[PASSWORD], and use my API key sk-proj-7Hf2kQa9Lx[API KEY] for the price check.
Illustrative example. Cloak Mode is on by default and swaps detected values for placeholders before any request leaves the backend, for every model endpoint, local ones included. Redaction is a guardrail, not a guarantee.
Stored on your Mac
Chats, documents and memory live on your machine. API keys are stored locally.
You pick the endpoint
Run local models with Ollama, or paste an API key. Prompts go to the endpoint you choose.
Cloak Mode, on by default
Detected keys, passwords, emails and account numbers are swapped for placeholders before a request leaves the backend.
Start with the data boundaryJoeBro stores workspace data on the Mac, but prompts go to the model endpoint the user selects. Cloak Mode replaces detected sensitive values; it does not make hosted inference local or guarantee every sensitive detail is removed. The documented iPhone setup pairs to a Mac that must remain open and awake.
Read more
Articles
Practical notes on where an assistant keeps its memory, what “local” does and does not mean, and how JoeBro works across Mac and iPhone.
Models & data boundaries
Local Ollama or hosted AI API? Choosing a model endpoint for JoeBro
A practical privacy guide to deciding where JoeBro sends prompts, how BYO API keys work, and what local inference does and does not protect.
Models & data boundaries
What JoeBro Cloak Mode redacts, and what it cannot promise
Understand JoeBro's default sensitive-value masking, its endpoint coverage, and why redaction is a useful guardrail rather than a privacy guarantee.
Models & data boundaries
Email and calendar with an AI assistant: keep the boundary visible
Using JoeBro with IMAP and calendar data while understanding local storage, permissions, and model-provider processing.
Memory & data ownership
AI memory you can find, inspect and edit
A practical look at JoeBro’s separate Mac and phone memory systems: where each lives, how relevant context is selected, and what remains under your control.
Memory & data ownership
Local AI means taking responsibility for your own data
Where JoeBro keeps workspace data, what portability does and does not mean, and why backups deserve care.
iPhone & connectivity
Pairing JoeBro Mobile safely: QR codes, tokens, and revoking a phone
A guide to what the JoeBro iPhone pairing QR code does, where the token is kept, how to revoke access, and what the mobile agent cannot configure.
iPhone & connectivity
Tailscale or home Wi-Fi for a private Mac-to-iPhone AI connection?
Compare JoeBro Mobile's documented Tailscale and Wi-Fi reachability options, including local-network permissions, token exposure, and the awake-host requirement.
iPhone & connectivity
Building JoeBro Mobile yourself: iOS version, signing, and push requirements
What a source-only iPhone companion means in practice: iOS and Xcode needs, bundle identity, free Apple ID builds, and paid push notification setup.
iPhone & connectivity
How JoeBro's heartbeat limits background model calls and notifications
Learn when JoeBro's phone heartbeat calls a model, which caps and quiet hours apply, and why the feature is off by default.
AI tools in practice
Editing documents beside the conversation in JoeBro
How JoeBro pairs a local Mac document editor with agent assistance, and what changes when you choose a hosted model.
AI tools in practice
From a question to a cited report: Deep Research in JoeBro
A look at JoeBro’s multi-source research workflow, its report tools, and the model and search privacy boundary.
AI tools in practice
MCP tools in JoeBro: add only the capabilities you choose
How JoeBro connects user-added MCP servers and why local tool access is part of the privacy decision.
App & infrastructure
My personal Raspberry Pi setup for JoeBro
A first-hand account of running JoeBro’s Python and SQLite backend headless on a Pi, with the limits clearly separated from its documented Mac install.
App & infrastructure
A native Mac app with a small local Python backend
Why JoeBro combines a SwiftUI Mac interface with a bundled Python standard-library backend, and where the local design stops.