Short, because there is little to say.

The app, free tier

• No network access. The free tier makes no network requests. Ever. The engine (innards-core) contains no networking code; it reads hardware and OS information from your own machine and writes the report to your screen or to a Markdown file you choose.
• What it reads: CPU model and load, memory and swap, storage devices and filesystem usage, GPU, battery health, temperatures and fan speeds, network interface types, the names and memory use of your largest processes, machine make and model from DMI, and, only if you enable it, drive health (SMART) data.
• Elevated rights are requested only for SMART data, through your operating system's own prompt. Declining disables that one probe and nothing else.
• No accounts, no telemetry, no crash reporting, no update checks. If a probe fails, that becomes a line in your report, not a message to us.
• Settings (language, level, region, license key, any API key) are a single JSON file in your OS config directory. Nothing is written anywhere else.

Narrated summaries (Supporter and up)

This is the only feature in the individual tiers that makes a network request, and it is opt-in: nothing is sent until you press "Write summary". When you do, the app calls api.anthropic.com directly with an API key you supply. There is no Innards server in between.

What is sent is the rendered report, not the raw snapshot:

• The summary line: machine make and model, CPU name and core count, memory size and type, storage size and kind, GPU name, OS name and version, battery health percentage, and the health score. On a machine whose make and model cannot be read, the app falls back to the hostname for the machine name.
• The verdict sentence.
• Each finding as its severity, category, title, body and suggested action, in the language and at the level you have selected.
• Each capability as workload, grade, score and limiting factors.
• If you tick "include recommendations": each upgrade recommendation's title, kind, impact, estimated cost, reasoning and whether it exceeds your stated budget.

What is never sent: serial numbers, the hostname (unless it is the only name available, as above), usernames, process lists, mount paths beyond those already named in a finding's title, network addresses, raw probe output or SMART attribute dumps. The API key itself goes only to Anthropic, as a request header.

Anthropic's handling of the request is governed by Anthropic's privacy policy and the terms of your API account.

License keys

Keys are verified offline against a public key built into the app. Supporter keys never expire and are never checked online. Pro and Team subscription keys carry an expiry date; when a key is within 30 days of expiry, the app contacts innards.app/api/license/refresh once at startup to fetch a renewed key. Only the key itself is sent, nothing about the machine or the report. If the request fails, the app keeps working until the key's expiry date.

Shopping links (Pro)

Where-to-buy links are plain search URLs to third-party retailers, built locally from the part name and your chosen region. Nothing is requested until you choose to open one, and what that retailer does then is governed by its own policy.

Cloud upload (Team and Enterprise)

Team and Enterprise licenses let the app upload reports to your organisation's own Threadwise server, either manually or on a schedule you turn on. It is off by default and does nothing until an endpoint and token are configured in Settings. Each upload is a scrubbed report: the rendered findings, capabilities and summary described above, plus the friendly machine label you set and the organisation slug from your license key, so a fleet can be told apart. The scrub removes serial numbers, the hostname, MAC addresses, the process list, and usernames in paths. Nothing goes to infrastructure we run: the receiving end is your organisation's Threadwise workspace, self-hosted for Enterprise.

This website

• No cookies, no analytics, no third-party scripts or fonts. Everything is served from this domain.
• The site is static and hosted on Cloudflare, which keeps standard, short-lived request logs (IP address, user agent, page requested) to operate and protect the service.
• Download buttons link to GitHub Releases; following one is subject to GitHub's privacy statement.
• Buying a license goes through Stripe Checkout, which handles the payment details; this site never sees your card. The key page afterwards fetches your key from this site's /api endpoint using the checkout session id in its URL, and the key and receipt are tied to the email you gave Stripe.

Questions

Open an issue on GitHub or email eugene.trotsan@gmail.com.

Last updated 21 September 2026.