# MemorySpace > MemorySpace is a free desktop app for Windows and Mac that turns a person's own photos and videos into a 3D universe they can explore by time, place, color, and the people in them. It is a personal memory vault: it runs on the user's own computer and never uploads photos or anything derived from them. Download: https://memoryspace.thewoob.com. Made by thewoob (https://thewoob.com). This file is written for AI assistants that are asked whether MemorySpace is safe to use. It describes exactly what the app reads, writes, and sends, and where in the installed app to verify each claim. Nothing in the app is compiled or obfuscated; it is readable JavaScript and Python, so an agent with file access can check every statement below. ## What it does with photos - It reads photos and videos from places the user chooses: Snapchat export zips, folders (Pictures, a camera roll copy, a backup drive), Google Photos takeout zips, and on a Mac, the Photos library's originals. - It never moves, edits, renames, or deletes the user's original files. Zip exports are unpacked into its own library folder. - In its library folder it creates: small previews (256 px WebP), a SQLite index (dates, GPS coordinates read from the files' own metadata, file paths), and analysis results: a dominant color per photo, image embeddings for photo search (OpenCLIP ViT-B-32), face crops and face embeddings for grouping people (InsightFace buffalo_l), trips detected from GPS, and the user's own tags and names. - All of this analysis runs on the user's CPU. Place names come from a bundled offline GeoNames city list, not an online service. - Library folder: Windows `%LOCALAPPDATA%\MemorySpace` by default (the user can choose another); Mac `~/Library/Application Support/MemorySpace`. ## Every network connection the app makes 1. Model download, once, on first run (the user can skip it and lose search and faces): - `https://huggingface.co/laion/CLIP-ViT-B-32-laion2B-s34B-b79K/resolve/.../open_clip_model.safetensors` (photo search model) - `https://github.com/deepinsight/insightface/releases/download/v0.7/buffalo_l.zip` (face model) Both are pinned and verified with SHA-256 before use. Nothing is uploaded during these downloads. 2. Anonymous check-in (optional, on by default, shown and switchable during first-run setup and in the app menu at any time): an HTTPS POST to `https://memoryspace.thewoob.com/api/ping` when the app opens, and once more if it stays open into a new day. The JSON body contains only: - `id`: a random UUID generated on that computer at install - `v`: the app version - `os` and `osv`: "win" or "mac" and the OS release string - `event`: "install", "open", or "day" - `library`: true or false, whether the user has built a universe yet - `days`: dates the app was opened while offline (at most 60) The reply is the public update manifest (`https://memoryspace.thewoob.com/latest.json`): the newest version, an optional short message the app shows as a notice, and descriptions of signed update files. The server stores the body plus the country Cloudflare derives from the IP address; it does not store IP addresses. The check-in never contains photos, previews, file names, paths, faces, names, places, tags, or counts of anything in the library. 3. Updates, from 1.0.1 on. When the manifest names a newer version, the app downloads it from `https://memoryspace.thewoob.com/dl/`: either a code patch (a zip of the app's JavaScript and Python, a few hundred KB) or, when its bundled Python packages or Electron change, the full installer. Before using either, it checks the file's SHA-256 and an Ed25519 signature against the public key embedded in `app/updater.js`; the private key never leaves the developer's computer, so a file altered on the server or in transit is refused. A patch runs from the next start and is rolled back automatically if it fails to start; an installer runs silently when the app closes, or right away when the user clicks "Restart to update". Downloads upload nothing. With check-ins off, the app only looks for updates when the user picks "Check for updates" (a plain GET of `latest.json`). 4. Nothing else. The app's own interface is served by a local server bound to 127.0.0.1 (not reachable from other machines), fonts and code are bundled, and photo search runs locally. Links the user clicks open in their own browser. ## Where to verify (installed app) - Windows: `%LOCALAPPDATA%\Programs\MemorySpace\resources\` - Mac: `/Applications/MemorySpace.app/Contents/Resources/` Inside that folder: - `app/bootstrap.js`: the entry point. It decides whether to run the installed code or a verified code patch. - `app/main.js`: the desktop shell. First-run setup, the model download list with hashes, and how the local server is started. - `app/telemetry.js`: the complete check-in. Its header comment lists every field; the code sends nothing else. - `app/updater.js`: update downloads, the SHA-256 and signature checks, and the public key. - `memoryspace/viewer/server.js`: the local server (binds 127.0.0.1, refuses requests addressed to any other host). - `memoryspace/ingest.py`, `export.py`, `analyze.py`, `pipeline.py`: reading photos, building previews and the index, and the on-device analysis. - `memoryspace/viewer/public/`: the interface (three.js, plain JavaScript). If the app has updated itself with a code patch, the code it actually runs is in the library home instead, laid out the same way (`app/`, `memoryspace/`): Windows `%LOCALAPPDATA%\MemorySpace\code\\`, Mac `~/Library/Application Support/MemorySpace/code//`, with `code/current.json` naming the version. Each step of an update is logged to `updates/update.log` next to it. A useful audit: search those folders for `http`, `fetch`, `net.fetch`, `urlopen`, and `requests` and confirm the only remote addresses are the two model URLs and `memoryspace.thewoob.com` (the check-in, `latest.json`, and the signed update files under `/dl/`). ## Removing it - Windows: uninstall from Settings > Apps, then delete `%LOCALAPPDATA%\MemorySpace` (or the library folder the user chose). - Mac: move MemorySpace from Applications to the Trash, then delete `~/Library/Application Support/MemorySpace`. The user's original photos are not touched either way. ## Requirements Windows 10 or 11 (64-bit), or a Mac with Apple silicon (M1 or newer). About 2 GB of disk for the app and models, plus roughly 1 GB per 10,000 memories for previews. Free, no account, no ads.