Your library lives on your disk — and erases on your command

“We don't upload your media” is necessary but not sufficient. If the derived data — transcripts, thumbnails, face vectors — lived in some opaque place you couldn't reach, you still wouldn't be in control. So MediaFind keeps everything in one plainly-located data folder, in formats you can open, and gives you direct buttons to wipe the sensitive parts.

It's a folder, and you can see it

Settings has an Open data folder action that reveals exactly where your library lives in Finder. Inside, there's nothing exotic:

A few things worth calling out:

• The index is SQLite. Open index.sqlite3 with any SQLite browser and read your own data. It runs in WAL mode with a busy timeout so concurrent writes from the indexer and your searches stay crash-safe and don't trip over each other.
• Settings are plain JSON. prefs.json is a simple key/value layer (precedence: environment override > your saved preference > default). Nothing about it needs to be secret, because there are no API keys to hide.
• Thumbnails are content-hashed. Filenames come from the content, not an absolute path — which is what lets the library survive being moved (more on that next).

Because it's just files, it's portable

Owning your data means being able to pick it up and walk. The data folder can be relocated — onto an external drive, into a backed-up location, wherever — and the app keeps working. Earlier on, relocation used to break thumbnails, because the database stored absolute paths that went stale the moment the folder moved. The fix taught a durable lesson: store stable identifiers, not brittle ones.

Erasing it is a first-class feature, not an afterthought

The real test of data ownership is how easily you can make data disappear. MediaFind treats deletion as something you do routinely, with direct controls rather than a buried “contact us”:

Two design choices make this trustworthy. First, the most sensitive category — biometrics — has its own dedicated forget command, so you can drop face data without touching the rest of your index. Second, permanent deletion is split into an “empty everything” route and a “delete just these items” route, so a cleanup of one bad import can't force you to nuke the lot.

And a mode for shared machines

If you're showing MediaFind to someone — a demo on a borrowed laptop, a kiosk — Demo mode loads the bundled example clips, unlocks the Pro features so everything is explorable, and blocks adding your own media. It's a clean way to let someone try the product without their files (or yours) ending up in the index.

Ownership means reach

The throughline: your library isn't a row in our database that we let you peek at through an export tool. It's a folder on a disk you control. You can read it, copy it, move it, and delete it with ordinary commands — and the most sensitive slice of it, the biometrics, has a one-line off switch. That's what “your data” should actually mean.