The Code Is Public
Today I'm making the Pikos codebase publicly available. You can read every line of code that runs on your machine, build the app from source, and verify for yourself that it does what I say it does.
Why
Pikos makes a specific promise: your content stays on your device. No accounts, no telemetry, no analytics inside the app. That's a strong claim, and there's no reason you should take my word for it.
A public codebase makes the claim auditable. You can read the Rust backend and see exactly where it makes network calls (the updater, and that's it). You can search the TypeScript frontend and confirm there are no tracking scripts. Even if you don't personally read the code, the fact that anyone can is the point.
Source-available, not open source
I'm being precise about the label. The code is publicly readable, but commercial redistribution is not permitted. This is source-available under a restrictive license, not an open source project in the OSI sense.
I'm not claiming open source goodwill while restricting usage. The code is public for a specific reason: transparency and trust. If you want to inspect, audit, or build the app for personal use, you can. If you want to fork it and sell it, you can't.
What you can do
- Read the code and understand how Pikos works
- Audit the privacy claims: verify that no data leaves your device
- Build from source and run a version you compiled yourself
- Report bugs and suggest improvements via GitHub Issues
- Reference the code in technical discussions or blog posts
What the codebase looks like
Pikos is a Tauri 2 app: a Rust backend with a React + TypeScript frontend. The data layer is SQLite with full-text search (FTS5). There's no server component, no API layer, no cloud anything. The entire stack runs on your machine.
The repository is a monorepo: apps/desktop is the Tauri app, packages/core is the shared TypeScript library (types, utilities, storage interface), and apps/marketing is this website.
Trust through transparency
Privacy claims from closed-source apps are marketing copy. You're trusting the company, not the code. That trust can break at any point: a new feature, a quiet SDK addition, an acquisition. You'd never know.
With a public codebase, the privacy promise is verifiable. If I ever added tracking or phoned home, it would be visible in the diff. That constraint is the point. It keeps me honest, and it should give you confidence that the app respects your data. Not because I said so, but because you can check.