Conifer

"Yours. Your key is stored encrypted and used only to call your provider for your request. Traffic passes through Conifer's gateway (2.5% fee) and your prompt goes to your provider under your agreement with them — HIPAA or no-training terms you hold with that provider govern that leg. Conifer keeps no conversation content from these calls unless the cloud chat content setting is on. "

"Each routed question sends numbers and categories describing the decision (request shape, timings, which side answered, what you did next), plus an irreversible fingerprint (one-way hash) of your message and system prompt, which cannot reconstruct the text. The text of what you typed and what a model wrote is never sent. Tied to your account; shown in the app's egress count. Cloud chat content (on by default, consent-versioned) On by default; turn it off anytime. The cloud lane necessarily transmits your prompt to serve the request (see Cloud-lane inference above); this consent governs whether we may retain it: encrypted per-account, erasable on withdrawal in one step. Retention limits and audit guarantees: section 03 below. Local chat content (on by default, separate) On by default and asked separately; turn it off anytime. Local conversations never leave your machine unless you allow sharing them for model improvement; sensitive-looking conversations are excluded on-device, and a conversation that ever looked sensitive never uploads its history. Your own API keys (BYOK) Your provider, under YOUR agreement with them. Your key is stored encrypted and used only to call your provider for your request; traffic passes through Conifer's gateway (2.5% fee). HIPAA or no-training terms you hold with that provider govern the provider leg. Conifer keeps no conversation content from these calls unless the cloud chat content consent is on. "

" Conifer routes each query to the cheapest model that can do the job, and the cheapest lane is the free one on your own hardware. So by default, everyday queries run locally: the model, the prompt, and the generated tokens stay on your machine. The engine does not phone home. It has no analytics, no error reporting, no model-usage telemetry, and no background ping. A local query touches the network zero times, unless one of the sharing settings is on (the usage-data setting above, or section 03). Those settings are on by default and each can be turned off in the app — the app's Local-only switch turns every one of them off at the wire in a single step. The only other outbound calls the engine makes are ones you start: downloading the weights for a model you asked to install, and checking for updates when you ask it to. Neither call carries your prompts or your data."

" Everything that does or does not cross the wire, in one glance: the local lane where it does not, and the cloud lane and account system where it can. The sections below say the same thing in full. Local inference Stays on your machine. The default lane for everyday queries: the model, the prompt, and the generated tokens run on your hardware and are not sent anywhere. The engine has no analytics, no error reports, no usage telemetry, and no phone-home. Cloud-lane inference The model provider you chose, and only if you allowed the cloud at all. The prompt and context for that one query cross the wire only when the router escalates a query local could not handle well. Disclosed in the run, never silent. Never happens in privacy-first mode. Usage data (on by default) On by default; turn it off anytime in the app's settings. While on, the app sends anonymized usage notes and, during the demo phase, the text of your prompts. Your device strips text that looks like keys, tokens, passwords, emails, or card numbers first; that redaction is best-effort, so assume anything you type may be included. This pipeline carries no model outputs and none of your files, and it is keyed to a random anonymous id, not your account. It is separate from the account-tied routing signals below, and the two are not joined. Every upload shows in the app's egress count. Routing signals (on by default) On by default; turn it off anytime. "

" Conifer is the front door to all inference: a router sends each query to the cheapest model that can do the job, starting with the free ones on your own hardware. By default everyday queries run locally, so the model, the prompt, and the tokens stay on your machine. The router may send a query to a cloud model when local is not good enough, and only if you allowed the cloud at all. This page covers exactly what can cross the wire, when, and to whom."

" ┌─ your machine │ the local model · your prompts · the tokens │ your files · your keys · your chats └─ stays here by default. cloud lane ──▸── only a query you allowed, only when local is not enough. "

" The three questions that decide whether you can use Conifer professionally, answered up front. The desktop app answers the same three from live state in Settings → Privacy & data. Does anything from my local chats leave my machine? By default, yes: Conifer shares conversation data and anonymized routing signals to improve routing, and usage data (including prompt text during the demo, captured only after best-effort on-device redaction — pattern redaction cannot catch everything). Turns that look sensitive are excluded on-device from every content channel: chat-content sharing and the usage prompt channel both apply the same sensitivity check before anything is stored or sent. Turn the sharing settings off in the app — or flip its Local-only switch — and the answer becomes no: local chats stay on your machine, enforced at every send path, and the app's egress ledger shows what actually left. Can I control what stays local? Yes. Prompts that look sensitive stay local by default (keep-sensitive-local); any chat can be pinned On-device; and the Local-only switch sets the whole app offline — chats, voice, sharing uploads, and scheduled workflow cloud steps make no cloud calls, checked at each send path (your signed-in session itself stays alive). When the router escalates a query, that one prompt and its context go to the provider for that single query — disclosed in the run, never silent. I brought my own API keys — whose terms apply? "

" The router may escalate a query to a cloud model when a local model is not good enough for it, and only if you allowed the cloud at all. When that happens, the prompt and the context for that one query go to the model provider you chose. We say so in the run; it is never silent. Once a query is on the cloud lane, the provider you chose handles it under their own terms, including whatever logging and retention their policy describes. Read the policy of the provider you route to. Conifer passes the query through; it does not keep its own copy unless you separately said yes to cloud chat content retention (section 03), and outside that consent the content is dropped after a short operational window. Privacy-first mode pins every query to a local model. Nothing crosses the wire in that mode: the cloud lane is not reached, no matter what the router would otherwise have chosen."

" Everything in this section is on by default and can be turned off individually in the app's settings, one consent at a time; no setting here implies another, and turning one off never turns off the rest. Each grant is versioned: you agree under a stated version of the consent terms, and if the terms change, sharing pauses until you re-confirm under the new ones. Every upload any of these settings causes is counted in the app's egress log. routing signals Numbers and categories describing each routing decision (request shape, timings, which side answered, what you did next), plus an irreversible fingerprint (a one-way hash) of your message and of the system prompt. A fingerprint cannot reconstruct the text; we use it only to spot duplicates and join records. The text of what you typed and what a model wrote is never sent. Tied to your account. cloud chat content A retention consent, not a new transmission: the cloud lane already carries your prompt to serve the request (section 02). With this consent we may keep that request and the model's answer, encrypted with a per-account key, to improve routing and models. Without it, cloud content is dropped after a short operational window. Withdrawal is one step and erases what was kept by destroying your account's encryption key. local chat content Asked separately, and never implied by anything else. Local conversations stay on your machine unless you allow sharing them, encrypted per-account, to improve the models everyone runs locally. "

" One account, one interface across the models you use. Signing in involves the account system, which holds: email The address you signed in with. Used to identify your account and contact you about it. No browsing profile is built from it. created_at Timestamp of first sign-in. last_sign_in Timestamp of the most recent sign-in. An account is optional for local-only use where it can be: running a local model does not require signing in. The account exists so that consolidated billing and cloud routing can be tied to you when you use them."

" The marketplace, where you pick and enable models, and the cloud routing lane are the two places a query can leave your machine. Choosing a model in the marketplace involves your account. Sending a query to a chosen cloud model involves that provider, as described in section 02. The local tier and privacy-first mode are the places a query does not leave your machine. If you never allow the cloud, or you pin to privacy-first mode, the router keeps every query on your hardware."

" The website is hosted by a static-site host that keeps standard request logs (IP, user agent, requested URL, response status) for abuse handling. If first-party site analytics are enabled they are aggregate only, used to understand traffic, not to profile individuals. The website is separate from the engine: nothing you do on the site reaches your local models."

" Conifer is not intended for children under 13 and does not knowingly collect data from them. If you learn that a child has signed up, write to the address above and the account will be deleted."

" For regulated teams, Conifer supports fleet governance: spend caps, and a routing policy that can be set to local-only so no query on those machines is allowed to reach a cloud provider. The policy is attestable and enforced client-side, on the device, so a machine can report exactly which routing posture it is under. Under a local-only fleet policy, the cloud lane is closed for every user on those machines, and inference stays on the endpoint."

" Account and sign-in The account system. Your email and the timestamps of sign-in, so you have one account across devices. Optional for local-only use where it can be. No passwords stored, no browsing profile. Billing The payment processor, for consolidated billing across the models you used. It holds your card details; Conifer never sees them. We receive a customer reference and the amounts, not the card. Model downloads The weights host, started by you, only for the models you ask to install. Update check The release host, only when you check for updates. The website Standard web-server request logs from the host for abuse handling. First-party site analytics if enabled, aggregate only. No selling of data. "

" Write to [email protected] from the address tied to your account and ask for a copy, a correction, or a deletion of the account and billing records held for you. We will do it within 30 days and confirm when it is done. EU and UK residents have the rights enumerated under GDPR; California residents have the rights enumerated under CCPA. Both reduce, in practice, to the email above. Local data on your own machine is yours to delete directly; the engine keeps no copy of it anywhere else."