8.5 – Network connections

QuartzControl works locally. It goes online only when a page needs to look up something that is not on your machine, or when you publish. A firewall such as Little Snitch reports these connections — often under names you would not immediately tie to QuartzControl. This page is the list for them.

There is no telemetry, no crash reporting and no phoning home apart from the version check below.

Which name the connections appear under

Name in the firewall	What is behind it
QuartzControl	the program itself, for instance for the marketplace and themes
QuartzControl Helper	QuartzControl’s Chromium network service (version check, template, live preview), as well as npm and Quartz
git-remote-https	git, talking to GitHub or to your own repository
curl	not QuartzControl but Homebrew — only on Macs with Homebrew, and only for older projects (see below)

npm and Quartz run on the Node runtime that ships inside QuartzControl. That is why they carry its name rather than “node”. Activity Monitor and lsof show npm under its own title, such as “npm install” — the program file is still QuartzControl Helper.

When what is contacted

When	Address	What for
Start of QuartzControl, start screen	raw.githubusercontent.com	Is there a newer version? (at most every six hours while QuartzControl runs)
Overview, Plugins, Updates	github.com	State of the Quartz core and the plugins (git ls-remote)
Plugins → Marketplace	api.github.com	List of community plugins
Styles → Community themes	api.github.com, registry.npmjs.org, cdn.jsdelivr.net	List of themes, details of a theme
Styles → a theme’s Style Settings	raw.githubusercontent.com	Obsidian’s theme directory and the theme’s CSS file
Create new project	raw.githubusercontent.com, github.com, registry.npmjs.org, fonts.googleapis.com	Template, cloning Quartz, dependencies, fonts for the first build
npm install, only with Homebrew and sharp up to 0.34.5	analytics.brew.sh	Homebrew’s usage statistics, triggered by a package npm installs (see below)
Installing a plugin, core or plugin update	github.com, registry.npmjs.org	Fetching sources and dependencies
Building, starting the preview	fonts.googleapis.com, fonts.gstatic.com	only when the fonts come from Google (Styles → Basics)
Live preview	whatever the site itself loads, e.g. cdn.jsdelivr.net, cdnjs.cloudflare.com	The preview shows the site the way a browser sees it
Signing in to GitHub, setting up Pages	api.github.com	only with a stored access
Git sync, publishing	your repository, your servers, your webhook	only where you set it up to go

The live preview is what surprises people most: the addresses that show up there are not loaded by QuartzControl but by the site being built — every visitor would make the same requests. Which ones depends on the project: fonts, maths, comments, themes — and an analytics service entered under Configuration.

The user handbook lives online at boxi-os.github.io. Help → Handbook and “Read this in the handbook” open it in the browser — so a firewall reports that connection under the browser’s name, not under QuartzControl.

What stays silent

Most connections belong to a page: if you never open the marketplace, QuartzControl never talks to api.github.com. You can also avoid:

• Google — have the fonts served locally under [[en/4-design/02-base-colours-and-fonts|Styles → Basics]]. The build then fetches them once, and the site loads them from your own server from then on.
• The checks on the overview — they run when a project is opened. Without a network they say “cannot check” and hold nothing up.
• Homebrew — during npm install for a new project, the image package sharp asks Homebrew for a path. What it asks with depends on its version: up to sharp 0.34.5 it was brew environment, and such a call reports to Homebrew’s usage statistics; since sharp 0.35.4 it is brew --prefix, which reports nothing. A project QuartzControl creates today gets 0.35.4. The statistics are Homebrew’s setting anyway, not QuartzControl’s: brew analytics off turns them off.

The version check at start cannot be turned off. It requests a single file and sends nothing beyond what every request to a web server carries.

How this list came about

Recorded on 2026-09-13 on QuartzControl in development with an empty profile, page by page, sampling the open connections of every process of QuartzControl every half second (lsof); addresses are matched to host names through their DNS records. Recorded: start, overview, plugins, marketplace, community themes, updates, preview with a running server, create new project. Read from the source code, not recorded: Style Settings, plugin installation, core update, GitHub sign-in, Git sync and publishing.

Re-measured on 2026-09-14 on QuartzControl 1.0.0-beta.2 (start, create new project, overview): the version check, npm and the first build run as QuartzControl Helper, git as git-remote-https. The curl was traced back to its caller: npm → the install script of sharp 0.34.5 → brew environment → Homebrew → curl to analytics.brew.sh. With Homebrew’s statistics switched off it did not appear.

That chain holds for the day it was measured and for no day after it: since 2026-09-15 Quartz pins sharp ^0.35.4 instead of ^0.34.5, and its install script calls brew --prefix. Counted on 2026-09-16 with a stand-in on HOMEBREW_CURL_PATH, statistics switched on: brew environment --plain calls curl twice, one of them to analytics.brew.sh — the other is only curl --version and talks to nobody. brew --prefix calls none: Homebrew is done before it even loads its statistics.