Privacy & Data
QualiLens runs entirely on your computer. It sends your data to exactly one place: the AI model provider you selected. Below is what leaves your computer, what stays, and what your ethics committee needs to know.
What leaves your computer
Analysis calls carry your data to the provider whose key you supplied, over a direct connection to that provider's API. There is no QualiLens server, no intermediary, no queue, and no relay.
| Stage | What is transmitted |
|---|---|
| Familiarization | First 60,000 characters of each source, verbatim |
| Coding | Every source in full, in 24,000-character segments |
| Grouping | Code names, definitions, excerpt counts, and up to two sample quotes per code |
| Extraction (lit. synthesis) | Every paper up to its reference list, then per-part notes for consolidation |
| Cross-paper synthesis | Extraction summaries and up to 14 quotes per paper (240 chars each) |
| Transcription | The recording itself, uploaded to OpenAI's speech-to-text service |
| Report narrative | Final structure with names, definitions, counts, and sample quotes |
| Test key / Check models | A trivial message (no data) / your key to its own provider's listing endpoint; for Google, also the word "ok" to its free token-counting endpoint, once per catalog model |
| Check for updates | Nothing of yours — one request to GitHub for the latest release, only when you press the button |
Your research question and setup answers travel with most calls. Your API key is sent to its own provider as an authorization header, and to nobody else.
What stays on your computer
No telemetry
No usage data, no analytics are collected. Nothing runs in the background.
No background connections
Each row in the transmission table is a call you initiated. Updates are pull-only.
Local only
The server binds to 127.0.0.1, answers only to requests that name this machine, refuses cross-site requests, and requires a per-launch session token on every API call. The token reaches your browser only through a launch page readable by your account, so neither your network, another web page in your browser, nor another account on the same computer can reach your data through the app.
Database on disk
The database, uploaded files, and your analysis stay on disk, readable by your account only. API keys in the database are encrypted with a secret held outside that folder; the participant data are not encrypted. Back up backend/data/.
What the provider does with your data
Your agreement with the provider governs that — not this software. Three questions matter: How long does the provider retain your inputs? May it use them to train models? Is a zero-retention arrangement available?
Settle all three with the provider before you upload human subjects data. QualiLens sends your data to that provider and to no one else.
One tier difference is stark. On Google's free tier — any key whose project AI Studio does not show on the paid tier, which means linking a billing account and prepaying at least $5 — Google's Gemini API terms let Google use what you send to improve its products and let human reviewers read it, outside the European Economic Area, Switzerland, and the United Kingdom. There, a free Gemini key is unsuitable for interview transcripts or other identifiable data. The manual's privacy chapter has the details.
Notes for an ethics application
These are the facts a committee will ask for, stated in the terms committees use.
Processing location
Analysis runs locally on the researcher's own computer. No study data are stored on any QualiLens server, because there is none.
Third-party transfer
Source text is transmitted to a named commercial AI model provider for analysis, over an encrypted connection, using the researcher's own account. Name the provider. Recordings are transmitted to OpenAI for transcription — disclose this as a separate transfer.
De-identification
The software performs none. Whatever is in the transcript is transmitted. De-identify before upload — upload is the only point at which de-identification can happen.
Storage and access
Study data are held in a single database file and an uploads folder on the researcher's computer, unencrypted, protected by the operating system's file permissions: the folder and the database are readable by the researcher's account only. The researcher's API keys in that database are encrypted with a secret held outside the folder. State whether the folder is synced to a cloud service; the study data are held by that service as well if it is.
Automated decision-making
An AI model produces coding proposals. The researcher reviews and approves all analytic structures at explicit checkpoints, and each checkpoint is logged.
Reproducibility
AI model coding is not deterministic — a second run will differ. The audit trail records the provider, the model requested and the model the provider reports answered each call, the settings frozen at the run's start, the sampling settings of every call, and all researcher decisions, and exports as one JSON file. This supports auditability rather than exact reproducibility.
Before you upload human subjects data
Confirm that the provider's data handling terms cover what your protocol promised your participants.
De-identify the transcripts. Upload is the last moment at which you can.
Decide whether your project folder should be excluded from cloud sync, and exclude it before the first upload.
Use a dedicated API key with a spending limit.
Run one short source end to end first, so that you see what is sent and what comes back before you commit the corpus.