For most of the 2010s, "cloud-first" was a feature. The pitch was simple: your data lives somewhere safe, accessible from any device, never lost when your laptop dies. We traded local files for sync, desktop apps for SaaS, and in the process handed over the raw bytes of our lives to a small handful of companies.
That bargain is collapsing in 2026. Not because of a single scandal, but because a decade of those scandals has finally added up. People are tired. The apps quietly winning the next decade are the ones that treat your device as the source of truth and the cloud as an optional relay. The label varies — local-first, privacy-first, on-device — but the shape is the same: data lives on hardware you own, encryption keys stay in your hands, and the vendor can't read your notes even if a court orders them to.
This is what's actually changed, which apps are leading, and where the trade-offs still bite.
1. What "local-first" actually means in 2026
The phrase has been around since Martin Kleppmann and Adam Wiggins wrote the original local-first software essay in 2019, but the meaning in 2026 is sharper and more concrete than the 2019 ideal. A genuinely local-first app today has five properties, in roughly this order of importance.
Data lives on your device first. When you create a note, a task, a calendar event, or a photo edit, the canonical copy is written to local storage immediately, before any network round-trip. There is no "save" button that posts to a server. There is no draft state that exists only in memory until the cloud catches up.
The app works fully offline. Disconnect your Wi-Fi and the app keeps working with zero feature loss. Sync resumes when the connection comes back, eventually and in the background. The app doesn't nag, doesn't degrade, and doesn't queue things in a sad "syncing…" spinner.
Sync is end-to-end encrypted. When the device does talk to a relay server, the bytes are encrypted with keys the vendor never sees. The server is dumb storage. A breach exposes ciphertext, not plaintext. A subpoena exposes the same ciphertext.
No accounts required for the basics. You can use the core functionality without signing up, creating an account, or sharing an email address. The app treats you as a customer, not as a data point.
Open formats, or at least documented ones. You can export your data in a standard format without writing a scraper. Markdown, plain text, SQLite, JSON — whatever the domain demands, but a format that won't vanish if the company shuts down.
That's the modern definition. Notice what's not on the list: the word "cloud". Cloud isn't forbidden. The cloud is just no longer in charge. A local-first app can absolutely use a cloud relay — many do. The point is that the cloud is an optimization, not the system of record.
The reason this matters more in 2026 than it did in 2019 is that the tooling finally caught up. CRDTs (Conflict-free Replicated Data Types) are mature enough to ship in production. E2EE sync engines like Automerge, Yjs, and ElectricSQL work at scale. SQLite has WebAssembly builds, so the same database can run on iOS, Android, Mac, Windows, Linux, and the browser without modification. Five years ago, building a local-first app was a research project. Today it's a quarter of engineering work.
2. Why cloud-everything lost its shine
The collapse didn't come from one event. It came from a hundred small ones, each of which would have been forgiven in isolation.
The 2021–2022 round of breaches set the baseline. T-Mobile, Twilio, LastPass, and a dozen others taught the public that "stored encrypted by us" is a contract you can't enforce. When LastPass lost its vault metadata in 2022, it was the moment a lot of technical people quietly moved their password manager offline. When the 23andMe breach exposed 6.9 million users' genetic data in 2023, the same people asked what else about their lives was sitting in a database they couldn't audit.
Then came the AI training question. In 2023 and 2024, users discovered — sometimes because of opt-out loopholes, sometimes because of fine print nobody read — that their notes, documents, and code were being fed into model training pipelines. Notion AI, Google Workspace, Microsoft Copilot, and the entire "AI features in your SaaS" wave made "what happens to my data?" a question users now ask before they sign up. For many, the answer was: I don't want to find out.
The subscription fatigue layered on top. The average knowledge worker in 2026 juggles 11–14 paid SaaS subscriptions. The mental overhead of remembering which app holds which slice of life, the cost creep, and the constant "your subscription will renew in 3 days" emails have made people crave software that just works without a billing relationship. Local-first apps can be paid for once, paid via flat license, or supported via open-source donations — but the meter isn't always running.
And underneath all of it, there's the slow accumulation of platform risk. Apple's "What's New in Privacy" reports, Google's tightened Play Store policies, and the EU's Digital Markets Act have created a regulatory floor that finally punishes the worst offenders. Companies that ignored privacy for a decade are now being forced to reckon with it, but the apps that built privacy in from day one are the ones that get to advertise it as a feature rather than scramble to bolt it on.
The result is a shift in the consumer default. In 2019, "I'll just put it in the cloud" was the path of least resistance. In 2026, "I'll keep it local" is. The friction flipped.
3. The local-first apps I'm using daily
I've been running a personal audit for about fourteen months now — replacing one cloud-first tool at a time with a local-first equivalent, and keeping notes on what works. Here's the current rotation, in order of how often I touch them.
Notes and writing: Obsidian for long-form and Apple Notes for ephemeral stuff. Obsidian stores everything as Markdown files in a folder I choose. I sync via iCloud Drive, which means Apple sees filenames and modification times but not the content. The vault is plain text — readable in fifty years, editable in vim, mine forever. Apple Notes is the compromise: not local-first in the strict sense, but the content is end-to-end encrypted when I turn on Advanced Data Protection, and the integration with iOS is friction-free enough that I use it for grocery lists and meeting prep.
Tasks and projects: Things 3 on Apple platforms, with the database living locally and iCloud acting as a dumb relay. I've tried a dozen task managers over the years. Things wins because it's fast, the UI is calm, and my data is in a SQLite file I can sqlite3 open if I really need to. No account, no subscription beyond the one-time license, no "AI summaries" of my todo list.
Calendar: Fantastical on macOS and iOS, with CalDAV pointing at a self-hosted Radicale server running on a $5/month VPS. This one is more setup work than most, but the win is total control. Fantastical reads the CalDAV, caches locally, and only talks to the server when there's a delta. If my VPS disappears tomorrow, I still have a complete local copy of every event I've ever scheduled.
Passwords: 1Password, with the secret key and master password stored only on my devices. Biometric unlock on iOS, standalone vaults on each platform, and the option to host the sync server myself if I ever want to. 1Password made the jump to true end-to-end encryption years ago, and the architecture is now standard for the category.
Email: Fastmail with PGP for sensitive threads, but mostly because I can export the entire mailbox as mbox in two clicks. The data portability is the local-first feature I care about most.
Photos: a self-hosted Immich instance, running on a Mini PC in my office with a 4TB NVMe drive. Immich talks to the iOS Photos app via a custom integration, so the experience is identical to iCloud Photos but the bytes never leave my network. Automatic face recognition, search, and albums — all running on my hardware, on my terms.
Backups: Arq encrypted to Backblaze B2. The encryption key is mine. Backblaze sees ciphertext blobs. If I stop paying, I download my data and decrypt it locally. No lock-in.
The pattern across all of these is the same: the vendor sells software, not my data. The business model is aligned with my interests because I'm the customer, not the product.
4. The trade-offs nobody mentions
Local-first is not free. There are real costs, and pretending otherwise is dishonest.
Setup time. The first month is painful. You have to choose apps, configure sync, set up backups, and learn the export formats. If you self-host anything, you need to learn basic server administration. For non-technical users, this is a serious barrier. The local-first community has gotten much better about this — most of the apps above work out of the box — but the moment you want to self-host a photo library or a CalDAV server, you're back in sysadmin territory.
Multi-device collaboration. Local-first is excellent for solo use. It's still rough when five people need to edit the same document at the same time. CRDTs solve the underlying problem, but the UI for live collaborative editing is still years behind Google Docs. For now, if your team's primary workflow is real-time co-editing, you may need to accept a cloud-based tool — but you can pair it with end-to-end encryption (like Cryptee or Standard Notes) and weekly local backups.
Mobile battery and storage. On-device encryption, local indexing, and offline-first databases all burn battery. On iOS in particular, apps that try to do too much in the background get killed by the system. The trade-off is improving every year — Apple's own apps have proven that local-first is possible on mobile — but you'll notice the difference between a 200MB cloud-wrapper and a properly local-first app.
The "what if I lose my phone?" problem. Local-first means your data lives on your devices. Lose all of them and lose all of your data — unless you set up backups. Cloud apps used to handle this by default. Local-first requires you to think about it. A solid backup setup (the Arq + Backblaze combination above) takes maybe a weekend to configure and then runs forever. Most people don't do it. That's the single biggest practical reason local-first apps fail in the wild.
Vendor longevity. Some of these apps will disappear. Companies shut down, founders move on, projects get abandoned. The local-first ethos mitigates this through open formats and data portability, but if your favourite app's export format is a proprietary blob, you're not really local-first. Check the export story before you commit.
5. How to audit your own stack for privacy leaks
You don't have to go full self-hosted overnight. A practical migration looks like three steps, taken over months, not days.
Step one: sort your apps by sensitivity. Make a list of every app you use. Mark each one as high, medium, or low sensitivity based on what's in it. Health data, finances, intimate notes, and passwords are high. Work documents and calendar are medium. Public social media is low. The high-sensitivity apps are where local-first pays off first.
Step two: replace the worst offenders first. Start with the apps that are both high-sensitivity and have the weakest privacy posture. For most people, this is the notes app, the password manager, and the photo library. Pick the local-first replacement that has the lowest friction — Obsidian if you're technical, Apple Notes with Advanced Data Protection if you're not — and migrate one app per weekend.
Step three: set up the backup habit. Before you delete a single file from a cloud app, configure a local backup of the new system. Arq, Restic, Borg, or even just an external drive with Time Machine — anything that gets you to three copies of important data, on two different media types, with one offsite. Test the restore. Don't trust backups you haven't actually used to recover a file.
Once the high-sensitivity apps are migrated, the medium-sensitivity ones get easier. Calendar and email both have excellent local-first or E2EE options. By the time you get to the low-sensitivity apps, the question isn't whether you can move them — it's whether you should.
The cloud isn't going away. It's still useful for collaboration, for streaming, for things that genuinely belong in the world rather than on your laptop. But the default has flipped. In 2026, the smart move is to keep your life on your devices by default, and use the cloud deliberately, for the things that benefit from it. The apps that figure this out will own the next decade. The apps that don't will keep having to add "we take your privacy seriously" landing pages that nobody believes anymore.