Local-first by design

What that means for you

Identity, memory and modules live in readable Markdown files on your device. Not in an opaque silo. You can copy them, version them, take them away, audit them with a text editor.

This website

The landing page and the informational pages need no account to be read. We don't use invasive behavioural telemetry to profile you. Essential technical cookies may be used by the hosting runtime; we don't sell data to third parties.

Visit statistics, without cookies

To know how the site, the WebApp and the App’s update checks are used, we count requests from the web server’s own logs: no cookies, no tracking script, nothing stored in your browser. For each request we keep the page, the time, the language, the response code, the family of browser, system and device (for example «Chrome», «Android», «mobile» — never the full browser string), the name of the site that sent you here, and the place: country, region and city. The place is worked out on our own server from your IP address with a local database (IP geolocation by DB-IP); it is approximate — usually where your internet provider is, never coordinates — and your address is not written into the statistics and is never sent to anyone to be located. To count visitors without recognising them we keep a fingerprint that changes every day, so two days of the same person cannot be linked; the key that makes it is destroyed after 15 days. The server logs themselves, which contain the addresses, are kept for 14 days; the statistics for three years.

CLM app and WebApp (the product)

The product is designed local-first: caches and indexes are regenerable; the .md files stay yours. The cloud sync of your profiles exists and is opt-in, profile by profile: off until you switch it on (it is described below). Encrypted blocks must never end up in the clear on disk.

If you create an account

There is nothing of what you write: no endpoint in this version receives your .md files, and the server knows what you are entitled to have, not what you write. What is there is the account: your email, your password (never in the clear — we keep only a fingerprint you cannot go back from), your sign-up date, your open sessions, and the technical details that make it work, such as a password recovery link until you use it or it expires. The server logs keep request IP addresses for a short time: they serve to stop repeated sign-in attempts.

Cloud sync of your profiles (opt-in, per profile)

One exception to the paragraph above, and only if you choose it: the cloud. If you switch it on — for all your profiles, or only for the ones you tick — the files of those profiles — the .md and .txt files, the same set as the export — are copied to an IllAIra server as they are: names, sizes, versions and content are stored in clear, not encrypted. Whoever administers that server can technically read them; nobody does, unless you ask for help with your own files. The blocks you encrypted in the App stay encrypted, because they are encrypted inside the file. Caches, indexes, preferences and chat histories are never synced. Your device remains the source of truth: the copy on the server is a bridge between your devices, not a backup, and in this beta it lives on a single disk. When the same file changes on two devices, the most recent change wins, and the copy it replaced stays in the profile’s backups on the device. Deleting a profile also removes its copy from the cloud; the backups on your device stay until you delete them. Removing a profile’s copy from the cloud deletes it from the server; deleting your account removes all of it.

Next to each file the server keeps when it was last uploaded, and for each profile it notes when one of your devices last downloaded a file from it — only the time, not which file — so that, if something stops syncing, we can see where. These times go away with the profile’s copy and with your account.

The Chat with your own key, and the model on your phone

If you put your own key into the App or the WebApp, the Chat sends your messages — and, in «Focus on my files», the passages of the profile’s files that match them — to the provider you chose, directly from your phone or your browser, under that provider’s terms: nothing of the conversation and nothing of the key passes through illaira.com, and no server of ours relays it. The key stays in the phone’s secure store or in the browser’s storage for your account, never in a link and never in a log; «Forget the key» removes it, and signing out of the account removes it too. With a model that runs on the phone, no connection is made. The blocks you encrypted never go to an AI service on the internet — neither with your own key nor with the IllAIra credits: in the App, once you have given the passphrase, their content can enter only the answers of a model on the phone, on your own computer or in your home network. Conversations stay on the device, per profile, and are never synced: they are not memory — what should last you save with the MemoKen, and you confirm. On the App, from 0.1.80, every conversation is also an .md file in the «chat history» folder inside IllAIra’s folder on your phone: yours to open, copy and delete, removed with the conversation and with the profile, never uploaded to the cloud; in the WebApp you can download the same file. On Android, plain-HTTP traffic is allowed only towards the addresses you type yourself as a base URL, for a model on your own computer; towards illaira.com the app speaks HTTPS only.

IllAIra credits: a model of ours, paid from your balance

If you choose a model of ours paid with IllAIra credits — today behind the developer mode, in the App and in the WebApp — your messages, and in «Focus on my files» the passages of the profile’s files that match them, go to the provider (DeepSeek) through the IllAIra server, under that provider’s terms. We keep none of the text: the server passes it on and records only the token count of each turn for the charge, in a file in your folder on the server, next to your balance. 1 credit = 1 cent of a dollar. The model on your phone and your own key never use credits.

Keys for agents

If you create a key for agents — so that an agent harness on your computer or phone can use your IllAIra credits — the server keeps only its fingerprint, never the key itself: it is shown to you once, when you create it. Next to the fingerprint it keeps the name you gave the key, the day it was created and the day it was last used, how much it spent today, and the daily limit if you set one. Each charge made with a key records which key it was, in the same file as your balance. The text of the turns follows the rule of the credits: it passes through and is not kept. You can revoke a key at any time, one by one or all together from your account, and the keys are deleted with your account.

What the server counts about accounts

For our own statistics the server also records, next to your account, the language and where you created it — in the App for Android, in the app for Windows or Linux (and which of the two), or in the browser — and the days your account was used: only the date, not what you did. The language and where you created the account stay with it and go away with it; the days of use are deleted after three years, or with the account.

The MemoKen and the clipboard

Off by default. If you turn it on in Settings, IllAIra asks Android to draw an icon over other apps and keeps a foreground service with a notification. The MemoKen does not read any app’s screen and does not watch the clipboard: it reads it in a single instant, when you put your finger on it, to know whether you copied a memory. At that moment Android may show its own notice “IllAIra pasted from your clipboard”: that is that one read, and the only one. If there is a memory, a panel appears next to the MemoKen to choose where to archive it, without leaving the chat. Nothing is written without your confirmation, and the texts stay on the device.

In the browser the MemoKen is an extension, and the path is a different one: it does not look at the clipboard and does not read the pages you open — it takes the text you have selected, and only when you click its icon.

The folder of the DROP face

The DROP face of the card copies the files you choose, in batches, into the folder Download › IllAIra › memoken-drop and offers them through Android’s Share sheet. Your files stay where they are; the folder is emptied and refilled at every batch. Nothing goes online.

Contact and updates

For skeletons, modules and early access we also use public channels (Patreon, for instance), whose privacy policies remain their own. You can delete your account yourself, from the Account page: it really does disappear — email, password fingerprint, sign-up date and sessions — and we don't keep a «deleted» copy somewhere. Your .md files are untouched: we never had them. For everything else — knowing what we hold, correcting it, or if you can no longer get in — write to privacy@illaira.com.

If the email address of an account is not confirmed within 30 days — the link arrives by email as soon as you sign up — the account is deleted from our server to free up space, the same way as when you delete it yourself, together with its cloud copy. Accounts created before this rule have 30 days from the email that told them about it.

Emails about your account are written in English and in your language: the one you signed up in, or the last one you used with IllAIra while signed in. We keep that language with the account for this purpose only, and it goes away with it.

Intellectual property

The method behind the Continuity Layer has been filed and is patent pending; IllAIra® is the name of the project. They cover the architecture and the name, not what you produce: the identity, memory and modules you write stay yours, and you can change them, share them or take them to another system without asking us anything.