14. Data, Privacy, and Governance

QualiLens runs entirely on your computer. It sends your data to exactly one place, which is the AI model provider you selected. Below is what leaves your computer, what stays, what deletion removes, and what an ethics committee will want to know.

What leaves your computer

Analysis calls carry your data to the provider whose key you supplied, over a direct connection to that provider’s API. There is no QualiLens server, no intermediary, no queue, and no relay.

Your research question and every setup answer travel with most calls. Anything identifying that you typed into those fields therefore travels too.

Your API key is sent to its own provider as an authorization header, and to nobody else.

The sampling settings each call ran with — the temperature where QualiLens sets one, and the token budget — are recorded on the call’s audit entry, because they differ by provider: Anthropic’s models, OpenAI’s reasoning models, and Google’s Gemini 3 and later run at the provider’s default temperature, the others at the value recorded. The token counts include the tokens a model spends thinking before it answers, which providers bill as output.

One thing you should know about what travels: the text of your sources is placed inside the prompt as data. Every prompt tells the model that the text between the fences is data and never an instruction, and no stage acts on anything the model says outside the JSON it is asked for. A document that contains instruction-like text — most plausibly a paper downloaded from the web in a literature synthesis — could still influence how the model reads it. Nothing in QualiLens can be made to act by such text; what it can do is colour an extraction, which the extraction review exists to catch.

What stays on your computer

The database, the uploaded files, and the analysis itself stay on disk. No usage data, no telemetry, and no analytics are collected, and nothing runs in the background: every row in the table above is a call you initiated. Updates are pull-only — QualiLens does not contact anyone unprompted, and the update check happens only when you press its button. The reminder to check, when the Projects page shows one, is worked out locally from the build’s date and the time of your last check; it makes no request.

The server binds to 127.0.0.1, so QualiLens is reachable only from the computer it runs on, and not from your network. Two routes remain on that computer, your browser and the other accounts on it, and both are closed. The server answers only when the request names 127.0.0.1 or localhost, refuses any request a browser marks as coming from an origin other than the app’s own (another site, or another program on this computer serving pages on another port), and requires a per-launch session token on every API call. A connection to 127.0.0.1 does not say which account on the computer made it, so the token reaches your browser only through the launch page the launcher opens, a file readable by your account alone, and the app gives it to no one else. A web page you have open in another tab cannot read your projects, start a run, or install anything through the app, and neither can a page that has been made to resolve to your own machine, or another person signed in to the same computer. An administrator of the computer, and anything running as your own account, remain outside this protection, as they are for every file you keep. Update bundles must carry a valid signature from the release key before a file is written, and a signed bundle older than the installed build is refused unless you ask for the rollback.

What the provider does with it

Your agreement with the provider governs that, rather than this software, and the terms differ between providers and between account tiers. Three questions matter. How long does the provider retain your inputs? May it use them to improve its models? Is an enterprise or zero-retention arrangement available to you? Settle all three with the provider before you upload human subjects data. QualiLens cannot answer them for you. Get a data processing agreement from the provider you intend to name if your protocol requires one.

One tier difference is stark enough to state here. Google’s Gemini API terms (last modified 28 April 2026) treat a key as a free, unpaid service unless its Google Cloud project is linked to an active billing account, and Google’s billing page adds that reaching the paid tier means linking a billing account and prepaying at least $5; AI Studio’s Projects page shows which tier each project is on. Outside the European Economic Area, Switzerland, and the United Kingdom, Google may use what you send on the unpaid service to improve its products, human reviewers may read it, and the terms ask you not to send sensitive, confidential, or personal information. On the paid service, Google says it does not use prompts or responses to improve its products, and inside those three regions the terms apply that paid-service rule to free keys as well. Outside them, a free Gemini key is therefore unsuitable for interview transcripts or other identifiable data: move the key’s project to the paid tier first. Inside them, confirm with your data protection officer that the terms cover what your protocol promises. Check the current terms at ai.google.dev before you name Google in a protocol, since they change.

The one thing QualiLens guarantees is that your data go to that provider and to nobody else.

Where things sit on disk

backend/data is the default; QUALILENS_DATA_DIR moves the database and the uploads to a folder of your choosing, and QUALILENS_SECRET_FILE moves the secret the same way. The Settings screen names the folder and the file in use. The folder and the database are readable by your account only; QualiLens sets that at every start.

Anyone with read access to the data folder has your data. Everything in it is synced as well if it sits inside a cloud-synced directory — the app says so at startup and in Settings when it detects one. The secret is not in it. Keep the data folder outside the synced tree if your protocol requires the data to stay on one machine (Getting Started).

API keys

Your keys are stored in the settings table of the database, encrypted (Fernet: AES-128 in CBC mode with an HMAC-SHA256 tag). The secret that encrypts them is a file outside the data folder, named in the table above and on the Settings screen, created the first time QualiLens needs it and readable by your account only. Keys are not held in a system keychain.

What this protects against, and what it does not. A copy of the database — synced, backed up, or handed over — carries no usable key without the secret, and the secret is not in the synced folder. Anyone who runs as your own account on your own computer can read both files, so the encryption does not protect a key from someone at your unlocked machine, and it does not protect the participant data at all, which remain plain text. This chapter says so because an ethics application must not claim more.

A database opened where the secret differs — on another computer, or after the secret file was replaced — shows each key as unreadable in Settings, with the reason. Paste the key again, or Remove it.

Two habits still follow. Use Remove in Settings before you hand the computer to anyone; the value then leaves the database file rather than lingering in freed space. And prefer a key scoped to this work, with its own spending limit, over a key that reaches your whole account.

What deletion actually deletes

Removing a source

Removing a source from the Data step or the project page deletes three things. It deletes the source record with its extracted text, every excerpt in every run that pointed at that source, and the original uploaded file on disk.

For that reason a source that a completed run cites is refused unless you insist: deleting it would leave that run’s report quoting a document that no longer exists. When you do insist, two things stay behind, and both can hold quoted material from that source. Reports you already generated hold their own stored copy of the analysis, including the quotes. An excerpt from a removed source therefore still appears in an existing report, and its view in coded document link then fails, because the document is gone. The event log likewise retains quoted fragments in entries recording dropped or rejected assignments.

Deleting a project

Deleting a project from the Projects list removes everything. That means every run, every code, every excerpt, every checkpoint and its recorded resolution, every logged event, every stored report, every source with its text, and every uploaded file. The confirmation dialog says the deletion cannot be undone, and it means it.

Use this operation when a participant withdraws and you must remove their data completely. It is the only operation that clears the stored reports and the event log.

Removing a key

Remove in Settings clears the stored value for that provider and compacts the database file, so the value leaves the file rather than lingering in freed space. It does not touch any project.

What is retained by design

Codes you delete or merge at a checkpoint are marked as deleted or merged rather than removed. The database therefore retains the analytic history that produced your final structure. Excerpts you reject at the framework checkpoint are written to the audit trail with their quote before they are removed.

This is deliberate. An audit trail that silently loses the evidence you rejected is not an audit trail. It also means the database holds more of your data than your report displays.

Notes for an ethics application

These are the facts a committee will ask for, stated in the terms committees use.

Processing location. Analysis runs locally on the researcher’s own computer. No study data are stored on any QualiLens server, because there is none.

Third-party transfer. Source text is transmitted to a named commercial AI model provider for analysis, over an encrypted connection, using the researcher’s own account. Name the provider you will use. The recording itself is transmitted to OpenAI where audio or video is transcribed. Disclose that as a separate transfer, even when a different provider performs the analysis.

De-identification. The software performs none. Whatever is in the transcript is what is transmitted, including names, places, and any other identifier a participant spoke aloud. De-identify before upload if your protocol requires it. Note that upload is the only point at which de-identification can happen.

Storage and access. Study data are held in a single database file and an uploads folder in the project directory, unencrypted, protected by the operating system’s file permissions: the folder and the database are readable by the researcher’s account only. The researcher’s API keys in that database are encrypted with a secret held outside the folder. State whether that directory is synced to a cloud service. The study data are held by that service as well if it is.

Retention and destruction. Data persist until deleted. Deleting a project removes all of it, including derived analyses, logs, and reports. Removing an individual source leaves quotes in previously generated reports and in the event log. Honor a withdrawal request by deleting the project.

Automated decision-making. An AI model produces the coding proposals. The researcher reviews and approves every analytic structure at explicit checkpoints, and each checkpoint is logged. No finding is produced without researcher approval.

Reproducibility. AI model coding is not deterministic, and a second run over the same data with the same settings will differ. The audit trail records the model, the provider, the settings frozen at the run’s start, the sampling settings of every call, and every researcher decision, and it exports as one JSON file from the run screen. That supports auditability rather than exact reproducibility. State the distinction rather than eliding it.

Software integrity. The application updates only from bundles signed by its authors’ release key, verified before installation; a local page cannot be reached by other web pages. State this if the committee asks how the analysis software is protected on the researcher’s machine.

A working checklist before you upload human subjects data

Confirm that the provider’s data handling terms cover what your protocol promised your participants.

De-identify the transcripts. Upload is the last moment at which you can.

Decide where the data folder lives before the first upload. If the app folder is synced, point QUALILENS_DATA_DIR at a folder that is not, or exclude the data folder from sync — before the first upload rather than after.

Use a dedicated API key with a spending limit.

Run one short source end to end first, so that you see what is sent and what comes back before you commit the corpus.