Below are the documented facts from DigUp’s repository and release notes regarding its source code, network connections, file reading rules, and installers so you can evaluate the app for yourself.
| Topic | What DigUp’s README says |
|---|---|
| Source code | Public at GitHub and can be built from source |
| License | MIT |
| Network use | Downloads the 865 MB model once; checks for updates once a day (can be turned off) |
| Account and telemetry | No account, no telemetry |
| Changes to your files | Only reads files; never changes, moves or uploads them |
| Files it never reads | Keys, certificates, password files, hidden folders like .ssh, apps, caches |
| Windows installer | Installs for you only with no admin rights; not signed yet |
Open source and license
DigUp is licensed under the MIT license. The code is public at https://github.com/ARahim3/DigUp and can be built from source. The README credits Google DeepMind’s EmbeddingGemma 2 (Apache 2.0) and llama.cpp (MIT), Sparkle (MIT) for Mac updates, and Tauri for the Windows and Linux app.
What stays on your computer
Nothing you index leaves your computer. DigUp goes online only to download the model once and to check for updates once a day. The update check sends nothing about your files, and you can turn it off. There is no account and no telemetry. The index is stored in one SQLite file on your computer. For more on how local indexing works, see local AI file search.
What DigUp reads and what it never touches
DigUp reads only the folders you choose. It only reads your files and never changes, moves or uploads them. It never reads keys, certificates, password files, hidden folders like .ssh, apps or caches. It never downloads files that only live in the cloud (iCloud on a Mac, OneDrive on Windows). Code is read only in the folders you pick for code search, and it skips anything that looks like a key or a password.
Installers and permissions
On a Mac, you install via DMG or Homebrew. The 0.6.1 release notes state that the Homebrew cask is only updated to a DMG signed and notarized as DigUp. When opening a video at a timestamp, macOS asks once whether DigUp may control QuickTime Player (see QuickTime permission prompt).
Windows and Linux are a beta (0.7.0-beta.1). On Windows, the setup file installs for you only with no admin rights. Because the installer is not signed yet, Windows may say it does not recognize the app (see Windows unsigned installer warning). On Linux, the .deb package is called dig-up and is installed with sudo apt install. On GNOME and KDE under Wayland, DigUp adds Ctrl+Shift+Space to the desktop’s keyboard settings during setup.
Checking your download
Download DigUp only from DigUp’s GitHub Releases page. Our download pages show each file’s SHA-256 hash as GitHub lists it.