“Privacy-first” is a claim every product in this category makes, and almost none of them show you anything. It is a policy page, a padlock and a promise. So here is the other thing: a receipt. Below is one real request, itemised — what crossed the line, what did not, and what was kept afterwards. Then, because a receipt you only show when it flatters you is marketing, the list of times something does leave.
The request that crosses
The question is “How did Q3 land against plan?”, asked against a spreadsheet sitting on the disk. Answering it needs a model, and the models run in the cloud. So something has to cross. The interesting part is not that something crossed — it is that you can read exactly what.
| Item | Crossed? | Why |
|---|---|---|
| 42 rows of numbers | Yes | The rows the question is actually about — not the workbook, not the other sheets |
| The question you typed | Yes | It is the prompt |
| The file itself | No | It stays on the disk. The rows were read out of it; it was not uploaded |
| A copy kept afterwards | No | Nothing is retained after the answer comes back, and none of it trains a model |
Total: 42 rows · 1.4 KB. The answer that came back was “Q3 landed 0.4% under plan — September carried it.” A whole quarter of a business, answered, and the thing that moved was smaller than the email telling you about it.
The request that does not
The second request is “Redact the account numbers in Contract.pdf” — and the receipt for it is empty. Nothing left this machine. No request, no account, no log. Fourteen account numbers were deleted, not covered with a black rectangle that lifts off in any PDF reader, and the network was off the entire time.
That is not a degraded mode or a feature that waits for a signal. Redaction is arithmetic on a file you already have, so it runs where the file already is. The same is true of opening, editing, exporting, searching by keyword, and every ordinary thing you do all day.
Where the line actually is
A privacy post that stops at the flattering example is the thing it claims to be against. So, plainly: “your files never leave your machine” is true of ordinary editing and is not true of everything. Four things cross, and each one crosses for a reason you can name.
| What you are doing | Does anything leave? | What exactly |
|---|---|---|
| Opening, editing, exporting, redacting, keyword search | No | Runs on the device, works with the network off |
| Asking the AI for something | Yes | The minimum the request needs — the rows, the passage, the question. Not the file |
| Sharing a document | Yes | The document, encrypted, so that the person you shared it with can open it |
| Search by meaning rather than by keyword | Yes | It needs an account and a network connection today. On-device embeddings are on the roadmap, not in the product |
| Transcribing a saved recording | Yes | The audio goes to a managed transcription service, and it needs a Plus plan. The live transcript is your operating system’s own speech engine and stays local |
Why itemise it instead of just promising
- A promise cannot be checked and a receipt can. “We respect your privacy” has no failure state. “42 rows · 1.4 KB” does — if it ever says something else, you know.
- It forces the engineering to be true. You cannot print an itemised receipt for a request that uploaded the whole file. Publishing the number is what stops the shortcut being taken quietly.
- It survives a change of ownership. Policies are rewritten in an afternoon. A product that only ever sends the rows has to be re-engineered to start sending files, and that is a much louder change.
- It makes the boundary a feature rather than a footnote. The people who need this most — legal, health, finance — are not reassured by a promise. They are reassured by a number they can put in a review.
Show the crossing. Never flatten it.
The rule this page is written under
The questions people actually ask
Can I work with the network off?
Yes, for everything that does not need a model — opening, editing, exporting, redacting and keyword search all work offline. The redaction example above was done with the network off deliberately, because that is the only way to demonstrate it rather than assert it.
Is my content used to train models?
No. Nothing sent for an AI request is retained after the answer returns, and none of it trains a model.
What if I do not want a particular calendar or event to be visible to the AI at all?
You can exclude a whole calendar or a single event. It is not a display filter — an excluded calendar is dropped before the connector is called, so no request is made to it in the first place. The difference matters: hiding something from a screen is not the same as never asking for it.
Is this end-to-end encrypted?
No, and we will not imply otherwise. Documents are encrypted, but the keys are wrapped under a server-held master key. See the security page for how each tier is stored.
How do I see this for myself?
The receipt on the home page is the live version of everything above — the same two requests, animated, with the same numbers. It is reading the same data this post was written from.
