Trust
Does my data leave the machine?
No, with three narrow, documented exceptions, and none of them carry your data. This page answers the question for the three people who usually ask it.
For the researcher
Your spreadsheet, your questions, and CLAIR's answers stay on your computer.
CLAIR reads your file into a database that lives on your machine, and runs its AI model through Ollama, also on your machine. When you ask a question, the text of that question never leaves your computer, and neither does CLAIR's answer, the SQL it wrote to compute it, or any value from your file.
There is no CLAIR account tied to your data, no cloud inference, and no external model API in the path between your question and your answer. The cell values, column names, dataset names, and file paths in your project are never transmitted, by construction, not by policy: the code has no field that could carry them.
The one honest limit: a program running under your own Windows or Mac account could still read the files on your disk directly, the same way it could read any other file you own. That is true of any local application and is not something CLAIR, or any offline app, defends against.
For the advisor or IRB reviewer
A structural claim, not a promise in a privacy policy.
CLAIR's no-content-egress claim is enforced by what the code cannot send, not only by what it says it won't send. The only paths that can send anything over the network are the three named on this page, and each carries a fixed, non-content payload: a signed token, an install identifier, or a batch of redacted, closed-schema metadata.
The compliance kit is written for exactly this review: it includes a data-flow diagram, a no-content-egress attestation, an offline-verification checklist you can run yourself, and wording for a data management plan or protocol.
For IT
A short, specific allowlist. Nothing else to open.
The backend binds to 127.0.0.1 only and refuses connections from anywhere else on the network; a local shared token gates the app's own API from other processes on the same machine. Nothing about the app requires opening an inbound port.
Outbound, there are exactly three uses of the network, all documented with hosts and payloads on the network contract page, written so you can copy it straight into a firewall rule. See security for the trust boundaries and the current alpha installer's code-signing status.
Read the details
Network contract
The exact hosts CLAIR ever talks to, what each one carries, and what it means for your firewall allowlist.
Telemetry
What optional product telemetry collects, what it never collects, and how to turn it off.
Compliance kit
The one-page summary for an advisor, a PI, or an IRB reviewer, with wording you can paste into a protocol.
Security
Trust boundaries, the local API token, device-bound licenses, and what is out of scope.