What stays on your PC, and what doesn't
Clara is built so that by default nothing leaves your computer. The model, the agent, search, memory, her voice, chats, files and the router all run locally. This page lists every exception — and every one of them is something you turn on.
1Never leaves your PC
- Your chats, Clara's memory about you, her personality and notes
- Everything she makes in her workspace (her Library)
- Your photos and files you send her
- Clara's voice is generated on your PC (Kokoro)
- The pairing tokens, API keys and account logins (encrypted with a key that only your user can read)
2Leaves your PC only when you turn it on
| Feature | What is sent | Where | You control it with |
|---|---|---|---|
| Web search & browsing | Your searches and the pages she visits | The websites / search engines (through your own SearXNG) | Asking her to search |
| Cloud boost | The task (e.g. coding job, picture or video prompt) | OpenRouter, then the model you picked (their privacy policies apply) | Adding a key, approval per task, daily/monthly caps |
| Connectors | API calls on your behalf | That service (Google, Spotify…) | Connecting the account; writes need your OK |
| Voice mode / dictation | What you say | Your phone's built-in speech recognizer (often Google's; depending on the phone and its settings it may run on the device or in the cloud) | Using the mic button or voice mode |
| Remote access | Encrypted traffic between your phone and PC | Tailscale's coordination servers (not your data) | Running setup/tailscale.sh |
| Installation & updates | Downloads of models and software | GitHub, Hugging Face, PyPI, npm, Docker Hub | Running the installer |
3Passwords
Website passwords live only on your phone, encrypted with Android's keystore. When Clara needs to sign in, your phone asks for your fingerprint, encrypts that one login for that one sign-in, and the browser fills it in. Clara never sees it, and the PC never stores it.
4Safety rules Clara can't change
Clara runs as her own Linux user in a sandbox: she can't see your home folder, can't use sudo, and her safety rules (Guardian) are files she can read but not modify. Sending, deleting, buying, installing, network and admin actions ask you on your phone first. Emails she reads are treated as untrusted: instructions inside them are ignored.
5The Clara phone app
The app talks only to your own PC (your Clara Bridge), over your home Wi-Fi or your private Tailscale network. It contains no analytics, ads, crash reporting or tracking libraries, and it never contacts the Clara project or any server of ours: we don't run any.
| On your phone | Why | Where it goes |
|---|---|---|
| Your PC's address and the pairing token | To reach your Clara | Stays on the phone (app storage) |
| Saved website logins (vault) | So Clara can sign in without seeing them | Stays on the phone, encrypted with the Android keystore; one login is sealed for your PC only when you approve a sign-in |
| Messages, photos and files you send | To talk to Clara | Your PC only |
| Microphone (voice mode, dictation) | To hear you | The phone's own speech recognizer turns speech into text; the text goes to your PC |
| Notifications | Replies, reminders, approval requests | Shown on the phone |
| Your OpenRouter key, if you add one | Cloud boost | Your PC, which stores it encrypted |
Temporary voice clips and previews live in the app's cache and are deleted by Android as needed. Uninstalling the app removes everything it stored on the phone. Data on your PC is yours to keep or delete (~/.local/share/clara).
6Changes & contact
Changes to this policy are published in docs/PRIVACY.md, with history at github.com/TheWiderLensInitiative/clara.
The Wider Lens Initiative Project: email clara@thewiderlens.info with questions or privacy requests, or open an issue at github.com/TheWiderLensInitiative/clara/issues (issues are public). Security problems: see SECURITY.md.
This page mirrors docs/PRIVACY.md in the Clara repository and is kept in step with it.