Skip to main content
Short answers to the privacy questions we hear most. For the full picture, start with the privacy overview and what data is sent to AI.

Your documents

No. Elephas reads, indexes and stores your documents on your computer. Indexing happens on your computer. Always. If you turn on Personal Sync, your documents travel to your other devices end-to-end encrypted, and Elephas cannot read them.
The extracted text, search index and chats are stored in an encrypted database, with keys in Keychain (Mac) or Credential Manager (Windows). The copies of the files you add are stored as ordinary files in the Elephas data folder, protected by your computer’s user account. See Where your data is stored.
Reading, indexing and searching your documents work offline. Answers with Local AI are generated on your computer, but Elephas confirms your plan online about once an hour. Elephas AI and your own API key need a connection. See Use Elephas offline.

AI and training

Elephas does not train models on your documents or questions. Cloud AI receives only what a question needs: the question, recent chat messages and matching passages. Whether a cloud provider keeps or trains on requests depends on that provider’s terms. With your own API key, your provider’s API terms apply. With Elephas AI, the app states that retention and training use by the model provider follow the provider’s own policies.
That depends on your choice. With Elephas AI, the gateway forwards requests to a third-party model provider, named on the Elephas AI card in Settings › AI. With your own API key, you pick the provider: OpenAI, Anthropic (Claude), Google Gemini, Groq, Mistral, xAI (Grok), DeepSeek, OpenRouter, Together AI, or a custom OpenAI-compatible endpoint. With Local AI, no provider is involved: an open model runs on your computer.
No. Requests go straight from your computer to your provider. Elephas checks your plan online before using your key, and that check sends only a device ID.
With Protect personal information when using cloud AI on, which is the default, Elephas replaces many common personal details with placeholders before sending. It hides many, not all. See Personal information protection.
No AI can. Elephas answers from your documents and cites your sources, so you can check every claim against the passage it came from. See Citations and sources.

Storage and retention

The Elephas AI gateway does not store prompts or answers. It logs only IDs, counts and decisions, such as token counts used to measure your AI allowance. Your chat history is stored on your computer, and on your other devices if you use Personal Sync.
Synced data is stored encrypted for as long as you use Personal Sync.
Anonymous events and error details, tied to a random Install ID. Never your documents, questions, answers, file names or account details. You can turn them off in Settings › Privacy. See Usage reports.

Where data is processed

Usage and error reports are processed by PostHog in the EU. Your documents and index are on your computer, wherever it is.
Elephas connects to its services and to AI providers over encrypted connections. Updates are signed and verified before they install. Note that cloud AI is not end-to-end encrypted: the provider reads your question and passages to answer.

GDPR and your rights

Compliance depends on how you use any tool, so we don’t make blanket compliance claims. What Elephas gives you is control: keep processing on your computer with Local AI, hide personal details before cloud AI, and see what was hidden. If you need a data processing agreement or information for your own assessment, contact support@elephas.app.
Your documents, index and chats are on your computer, where you can delete them. For your Elephas account, email support. See Delete your data and account.
Team Brains are shared with the members who have access. The Team audit log records who did what, such as sign-ins, role changes and device approvals, but never what a document says. See Team roles and permissions.

Privacy overview

What data is sent to AI

Personal information protection

Sync encryption