Local by default. The cloud only when you allow it.
Conifer is the front door to all inference: a router sends each query to the cheapest model that can do the job, starting with the free ones on your own hardware. By default everyday queries run locally, so the model, the prompt, and the tokens stay on your machine. The router may send a query to a cloud model when local is not good enough, and only if you allowed the cloud at all. This page covers exactly what can cross the wire, when, and to whom.
┌─ your machine │ the local model · your prompts · the tokens │ your files · your keys · your chats └─ stays here by default. cloud lane ──▸── only a query you allowed, only when local is not enough.
Everything that does or does not cross the wire, in one glance: the local lane where it does not, and the cloud lane and account system where it can. The sections below say the same thing in full.
- Local inference
- Stays on your machine. The default lane for everyday queries: the model, the prompt, and the generated tokens run on your hardware and are not sent anywhere. The engine has no analytics, no error reports, no usage telemetry, and no phone-home.
- Cloud-lane inference
- The model provider you chose, and only if you allowed the cloud at all. The prompt and context for that one query cross the wire only when the router escalates a query local could not handle well. Disclosed in the run, never silent. Never happens in privacy-first mode.
- Usage data (opt-in)
- Off by default. If you turn it on, the app sends anonymized usage notes and, during the demo phase, the text of your prompts. Your device strips text that looks like keys, tokens, passwords, emails, or card numbers first; that redaction is best-effort, so assume anything you type may be included. This pipeline carries no model outputs and none of your files, and it is keyed to a random anonymous id, not your account. It is separate from the account-tied routing signals below, and the two are not joined. Every upload shows in the app's egress count.
- Routing signals (opt-in)
- On by default; turn it off anytime. Each routed question sends numbers and categories describing the decision (request shape, timings, which side answered, what you did next), plus an irreversible fingerprint (one-way hash) of your message and system prompt, which cannot reconstruct the text. The text of what you typed and what a model wrote is never sent. Tied to your account; shown in the app's egress count.
- Cloud chat content (opt-in, consent-versioned)
- On by default; turn it off anytime. The cloud lane necessarily transmits your prompt to serve the request (see Cloud-lane inference above); this consent governs whether we may retain it: encrypted per-account, erasable on withdrawal in one step. Retention limits and audit guarantees: section 03 below.
- Local chat content (opt-in, separate)
- On by default and asked separately; turn it off anytime. Local conversations never leave your machine unless you allow sharing them for model improvement; sensitive-looking conversations are excluded on-device.
- Account and sign-in
- The account system. Your email and the timestamps of sign-in, so you have one account across devices. Optional for local-only use where it can be. No passwords stored, no browsing profile.
- Billing
- The payment processor, for consolidated billing across the models you used. It holds your card details; Conifer never sees them. We receive a customer reference and the amounts, not the card.
- Model downloads
- The weights host, started by you, only for the models you ask to install.
- Update check
- The release host, only when you check for updates.
- The website
- Standard web-server request logs from the host for abuse handling. First-party site analytics if enabled, aggregate only. No selling of data.
Local inference stays local
Conifer routes each query to the cheapest model that can do the job, and the cheapest lane is the free one on your own hardware. So by default, everyday queries run locally: the model, the prompt, and the generated tokens stay on your machine. The engine does not phone home. It has no analytics, no error reporting, no model-usage telemetry, and no background ping.
A local query touches the network zero times, unless you turned on one of the opt-in sharing settings (the usage-data opt-in above, or section 03); by default none are on. The only outbound calls the engine makes are ones you start: downloading the weights for a model you asked to install, and checking for updates when you ask it to. Neither call carries your prompts or your data.
Cloud-lane routing
The router may escalate a query to a cloud model when a local model is not good enough for it, and only if you allowed the cloud at all. When that happens, the prompt and the context for that one query go to the model provider you chose. We say so in the run; it is never silent.
Once a query is on the cloud lane, the provider you chose handles it under their own terms, including whatever logging and retention their policy describes. Read the policy of the provider you route to. Conifer passes the query through; it does not keep its own copy unless you separately said yes to cloud chat content retention (section 03), and outside that consent the content is dropped after a short operational window.
Privacy-first mode pins every query to a local model. Nothing crosses the wire in that mode: the cloud lane is not reached, no matter what the router would otherwise have chosen.
Routing signals and chat content
Everything in this section is on by default and can be turned off individually in the app's settings, one consent at a time; no setting here implies another, and turning one off never turns off the rest. Each grant is versioned: you agree under a stated version of the consent terms, and if the terms change, sharing pauses until you re-confirm under the new ones. Every upload any of these settings causes is counted in the app's egress log.
- routing signals
- Numbers and categories describing each routing decision (request shape, timings, which side answered, what you did next), plus an irreversible fingerprint (a one-way hash) of your message and of the system prompt. A fingerprint cannot reconstruct the text; we use it only to spot duplicates and join records. The text of what you typed and what a model wrote is never sent. Tied to your account.
- cloud chat content
- A retention consent, not a new transmission: the cloud lane already carries your prompt to serve the request (section 02). With this consent we may keep that request and the model's answer, encrypted with a per-account key, to improve routing and models. Without it, cloud content is dropped after a short operational window. Withdrawal is one step and erases what was kept by destroying your account's encryption key.
- local chat content
- Asked separately, and never implied by anything else. Local conversations stay on your machine unless you explicitly opt in to sharing them, encrypted per-account, to improve the models everyone runs locally. Conversations that look sensitive are excluded on-device even under this setting. Withdrawal erases what was uploaded. No local-content upload path ships in this build — turning this on records your consent for a future build; nothing is uploaded today.
- training use
- A separate consent for using content you already agreed to share in training runs for Conifer's models and router. Withdrawing stops future training use; models already trained aren't un-trained, but every training run and its inputs are recorded and auditable.
Account and sign-in
One account, one interface across the models you use. Signing in involves the account system, which holds:
- The address you signed in with. Used to identify your account and contact you about it. No browsing profile is built from it.
- created_at
- Timestamp of first sign-in.
- last_sign_in
- Timestamp of the most recent sign-in.
An account is optional for local-only use where it can be: running a local model does not require signing in. The account exists so that consolidated billing and cloud routing can be tied to you when you use them.
Billing
Conifer gives you one bill across every model you used, local and cloud. Local inference on your own hardware is the free tier: it costs nothing to run and adds nothing to the bill. When you use paid cloud models, billing runs through the payment processor.
The payment processor holds your card details; Conifer never sees them. We receive a customer reference and the amounts charged, which we keep next to your account so we can show you what you spent and on which models. We do not sell this data.
The marketplace and routing
The marketplace, where you pick and enable models, and the cloud routing lane are the two places a query can leave your machine. Choosing a model in the marketplace involves your account. Sending a query to a chosen cloud model involves that provider, as described in section 02.
The local tier and privacy-first mode are the places a query does not leave your machine. If you never allow the cloud, or you pin to privacy-first mode, the router keeps every query on your hardware.
Enterprise governance
For regulated teams, Conifer supports fleet governance: spend caps, and a routing policy that can be set to local-only so no query on those machines is allowed to reach a cloud provider. The policy is attestable and enforced client-side, on the device, so a machine can report exactly which routing posture it is under.
Under a local-only fleet policy, the cloud lane is closed for every user on those machines, and inference stays on the endpoint.
What the website logs
The website is hosted by a static-site host that keeps standard request logs (IP, user agent, requested URL, response status) for abuse handling. If first-party site analytics are enabled they are aggregate only, used to understand traffic, not to profile individuals. The website is separate from the engine: nothing you do on the site reaches your local models.
Your rights
Write to contact@conifer.build from the address tied to your account and ask for a copy, a correction, or a deletion of the account and billing records held for you. We will do it within 30 days and confirm when it is done. EU and UK residents have the rights enumerated under GDPR; California residents have the rights enumerated under CCPA. Both reduce, in practice, to the email above. Local data on your own machine is yours to delete directly; the engine keeps no copy of it anywhere else.
Children
Conifer is not intended for children under 13 and does not knowingly collect data from them. If you learn that a child has signed up, write to the address above and the account will be deleted.
Changes
Material changes to this policy are announced on this page and, for active accounts, by email. The date at the top is the most recent revision.