Trust

Telemetry

Anonymous, content-free product telemetry, on by default during the invited alpha and disclosed at first run, opt-in once CLAIR is generally available. Here is exactly what that means.

Telemetry tells us how CLAIR performs and which features get used, so we know what to fix first. It never tells us anything about what is in your files, what you asked, or what CLAIR answered. This is enforced by a single redaction step every event passes through before it is ever queued: any field that is not on a fixed, closed list is dropped, and the whole event is discarded rather than sent partially.

During the invited alpha, telemetry is on by default, disclosed on first run with a clear summary of what is and is not sent, and can be turned off at any time in one place. It becomes opt-in, off until you turn it on, once CLAIR is available more broadly.

What is collected

Six categories, all metadata

Every event carries a category name, a timing or count, and a small set of closed labels. None of these categories can carry free text.

App health and performance

Startup time, whether the AI model loaded warm or cold, memory pressure, and whether the backend crashed.

Feature adoption

Which features you open, and whether it is the first time or a repeat use. Never what you did inside them.

Model and hardware

Your detected hardware tier, RAM and VRAM in coarse ranges, and which AI model is selected.

Data shape, never content

File type, and row and column counts in coarse ranges, for example "100 to 250 rows." Never a file name, dataset name, or column name.

Error signals

A closed category for what kind of error happened, for example "timeout" or "database locked." Never the error message itself.

Engagement

Roughly how many times you have launched CLAIR and how long a session lasted, bucketed so no single session stands out.

During the alpha, this also includes a more detailed layer of interaction timing, such as how long a screen was open or whether a control was clicked, so early bugs surface faster. That layer is built entirely from CLAIR's own fixed list of screen and button names, the same discipline as everything else here: never the value you typed, never a dataset or column name.

What is never collected

Blocked before it can be sent, not after

These are not policy promises. There is no field in any event schema that accepts any of them, so an attempt to add one produces a dropped event, not a leak.

  • Any cell value from any file you upload
  • Column names, dataset names, file names, or file paths
  • The text of a question you ask, or CLAIR's answer to it
  • Generated SQL
  • Your name, email, institution, or IP address
  • Your operating-system username, hostname, or MAC address

Your controls

Turn it off, see it, delete it

Turn it off

Settings → Privacy has a single switch. Turning it off immediately stops collection and empties anything queued but not yet sent.

See exactly what was sent

The same panel shows a live log of every event, with a raw view of the exact data behind it, and an option to export the whole log as a file for your own records.

Delete what was collected

One button asks the ingest server to delete every event tied to your install and confirms the count removed.

Where it goes

telemetry.clairanalytics.org

Accepted events are re-checked against the same redaction rules on arrival, as a second layer of defense, then stored. See the network contract for the host and payload alongside CLAIR's other two network uses.