Trust
Network contract
CLAIR touches the network for exactly three things, and none of them carry your data. This is the page to hand your IT team for a firewall allowlist.
CLAIR is a single-user desktop application. There is no CLAIR cloud account, no cloud inference, and no server-side copy of your data anywhere. The table below lists the three network uses that are structural to running the app at all, then the one optional channel you can switch off, then a small set of additional first-run and setup downloads that also touch the network. Every row names the exact host and what it carries.
The three required uses
| # | Purpose | Host | Carries | When |
|---|---|---|---|---|
| 1 | Model download | registry.ollama.ai (third party, today) | Ollama model weights only | When you install or change an AI model, including the one CLAIR suggests during setup |
| 2 | App update check and download | clairanalytics.org (updates.clairanalytics.org) | A signed update manifest from updates.clairanalytics.org; if you choose to install an update, the installer itself comes from downloads.clairanalytics.org | On launch, to check for a new version. Updates are never installed without your confirmation |
| 3 | License activation and renewal | clairanalytics.org (api.clairanalytics.org) | Your account email or license key, a salted hash of a device identifier, and a signed token in return | Once at sign-in, then a periodic background renewal while your license is valid |
Today, model downloads come from Ollama's own public registry, a third party rather than a CLAIR-controlled host. This is the one entry that is not a clairanalytics.org host; if your network allowlist is scoped to CLAIR's own domain only, this download will need its own rule.
The one optional channel
| # | Purpose | Host | Carries | When |
|---|---|---|---|---|
| optional | Product telemetry | clairanalytics.org (telemetry.clairanalytics.org) | Redacted, closed-schema usage metadata only: timings, feature use, bucketed dataset size. Never cell values, column or dataset names, file paths, or the text of a question or answer | In small batches, only while telemetry is turned on. On by default during the invited alpha with a first-run notice and a Settings switch; opt-in at general availability |
Full detail, including exactly what is and is not collected, is on the telemetry page.
Additional first-run and setup downloads
A small number of one-time setup downloads also reach the network. None of them carry account or dataset data; each request is a fixed, hardcoded lookup with nothing about you or your data in it, and each downloaded file is checksum-verified before use.
| Purpose | Host | Carries |
|---|---|---|
| Accelerated model formats (ONNX) | huggingface.co | A fixed, named model file from a public catalog. No user data in the request. |
| First-run engine setup | github.com/ollama/ollama (a pinned release) | The Ollama engine installer, checksum-verified before it runs. Only on a first run where the engine is not already present. |
| First-run library download | downloads.clairanalytics.org (CLAIR's own file host) | The machine-learning library bundle, checksum-verified before it runs. Only on a first run where it is not already bundled. |
What happens offline
The design principle is: online to activate or renew, offline to use. Once your license is active, CLAIR runs with no network connection at all, including AI inference, since the model runs locally through Ollama.
- Activation: the first sign-in needs one connection, to bind your license to this device and receive a signed token.
- Renewal is the only recurring network touch. A license token is valid for a fixed period (one month for the first two renewals, then three months, or a longer discounted annual token), and renewing it is what keeps the app usable. Renewal runs silently in the background starting about a week before expiry, on the next time the machine has a network connection. It never interrupts an analysis in progress.
- Grace for a momentary disconnect: losing wifi briefly does not lock the app. Only a confirmed rejection from the license server, or a token that fully expires with zero contact, locks it.
- Device changes: a license can move to a new device once every 30 days. Trying again sooner is refused; the original device keeps working until its own token naturally expires.
- Transparency: Settings → About shows the current license state in plain language, for example "Subscription verified, next check in 23 days," so renewal is never a surprise.