Proof,
not promises.
Most privacy pages ask you to trust a policy. Spike Local's model is simpler: your data physically stays on your machine, and the app shows you — live — every route it could ever take.
What stays. What could leave. Who decides.
| Where it lives | When it could leave | |
|---|---|---|
| Your files & index | Your disk | Never — the index is never uploaded |
| The knowledge graph | Your disk | Never |
| Meeting recordings | Your disk, transcribed locally | Never |
| Model inference | This machine — or your own box on your LAN | Only if you configure a cloud model, per trust zones |
| Web search queries | — | Only the search terms, only when you use web features |
| Telemetry & analytics | Doesn't exist | Nothing to send |
If you ever add a cloud model, you set the rules first.
Cloud is strictly opt-in — your own API key, your own provider. Before a single request can go out, every folder gets a trust tier, and the strictest tier touching a question always wins. Unclassified content fails closed: it stays local.
- L
Local only
This folder's content never reaches a cloud model, no matter what. The default for everything.
- R
Redact first
May be used — after emails, phone numbers, and long ID numbers are masked on your machine.
- C
Cloud OK
You've explicitly marked this folder as safe for your chosen provider.
A privacy report generated from the running app.
Settings → Privacy & Proof renders this from the app's actual configuration — not from marketing copy. Add a cloud key and the posture flips to "cloud-capable" and says exactly which routes exist. Route inference to your own workstation and it reports the real address, labeled as your own hardware.
The same honesty runs through the UI: every answer carries a badge — Local, LAN, Web, or Cloud — so you always know where a response was computed, per message, not per policy.
Rules the code actually follows.
No account. No login. No telemetry.
Spike has nothing to sign up for. There is no usage analytics, no crash reporter phoning home, no "anonymous" metrics. Even the license check is an offline cryptographic signature — it verifies without sending anything, and keeps working 21 days with no network at all.
Fail closed.
Whenever the app can't classify content — a new folder, an unmatched path — it's treated as local-only. Ambiguity never leaks.
Secrets stay out of backups.
Backup files carry your notes, memory, and settings — never your API keys. A portable file can't leak a credential.
Your own hardware isn't "the cloud."
Pointing inference at your GPU workstation over the LAN keeps everything inside your walls — and Spike labels it as exactly that, a third state between local and cloud, never blurred into either.
Audit it yourself.
Install Spike, open Settings → Privacy & Proof, and read the report. Then unplug the network and watch everything keep working.