Our privacy approach, not the legal notice
Privacy claims are easy to write and hard to keep. This page describes the three ways the product can run, and what each one actually does with your data - including the one that sends it somewhere.
Everything runs on your device.
The model, the document index and your memory all sit on your computer. In local-only mode the application is designed to work with no network connection at all, so there is nowhere for a document to go.
What this does not doAnswer quality and speed are bounded by your hardware. A laptop will not match the largest cloud models.
Your computer serves your own approved devices.
One machine - a desktop at home, a server in your office - does the work, and the devices you have approved can reach it over your own network. Your documents still never leave equipment you control.
What this does not doYou are responsible for the network it runs on. This mode is designed, not built, and is not part of the first private beta.
Optional, one request at a time, only when you approve it.
When a task genuinely needs a larger model, the request passes the Privacy Gateway first: it is classified, redacted where redaction is possible, and shown to you before anything is sent. If you decline, nothing is sent.
What this does not doThis mode does involve sending data to a third-party provider. What you approve does leave your computer, and that provider’s own terms then apply to it.
This request would leave your computer
You asked for a longer draft than the local model handles well. Sending it means the text below goes to the cloud provider you selected, under their terms.
Controlled Cloud is the mode where data leaves. We could have left it out of the marketing and put it in a settings screen, and plenty of products do. Instead: if you turn it on and approve a request, the content of that request goes to the provider you chose, is handled under their terms, and may be retained by them according to their policy rather than ours.
Redaction helps where the sensitive part is detectable - names, numbers, identifiers. It cannot help where the sensitivity is in the substance of what you wrote. The approval panel therefore shows you the exact text that would be sent, rather than a summary of it.
We keep a register of every privacy and capability claim, the evidence behind it, and the wording that is forbidden. Four entries from it, in plain sight:
Designed to keep supported processing on your own computer. In local-only mode the application is designed to work with no network connection. Local-only mode is a strong, checkable property. “Absolute privacy” is not a property at all.
There is no end-to-end encryption in this product, so there is no sentence anywhere on this site claiming there is. If that changes, it changes after implementation and verification, not before.
No audit, certification or attestation of any kind has been carried out. A prelaunch product claiming a compliance badge is telling you something about the company rather than about the software.
Hardware compatibility varies, and we have tested a narrow range so far. The compatibility page gives you bands and trade-offs instead of a green tick we cannot stand behind.
For what this website itself collects, see the privacy notice. For how the application is built and updated, see security.