By default it checks for updates every day, you can disable that in settings
By default it tries to get your profile from some default relays, you can change the relays or remove all of them for disabling this
Bunker requests (usually used for web apps) have some default relays, you can change it in the settings
Bunker requests in the last few updates generates a new key for each app.
The offline version can't connect to the internet, not even localhost since it also needs network permission
In all cases clients know who you are and most nostr requests can leak information about who you are and what are you doing
For bunker requests I recommend using a local relay like citrine for a faster experience but not all clients accepts connections to local relays