Field note
Does local-first mean private in every circumstance?
Local processing avoids an application upload path, but device backups, browser extensions, operating-system services, downloaded-file handlers, and hosting requests remain outside the app boundary.
What is processed temporarily
Imported source records exist in browser memory while strict parsing and bounded profiling run. The product does not upload them or retain them in its project, but temporary processing still matters for permission decisions.
What is saved
The local project stores names, authored definitions, value lists, notes, review records, editions, and bounded observed aggregates. Checkpoints and packets contain that authored material.
What remains your decision
Browser extensions, operating-system services, backups, malware, shared-device access, and downloaded-file handlers are outside the application boundary. Hosted use also makes ordinary requests to the selected host.
Worked example from the sample project
Import the sample CSV from the worked example page and watch what survives. During the import the rows exist in browser memory while the strict parser and the bounded profiler run. When profiling finishes, the studio keeps the field names and the bounded aggregates and discards the rows. Nothing in the saved project, the checkpoint or the packet contains a source record.
That is a genuine reduction in exposure, and it is still not the same as permission. Opening a file on a device brings it into that device's world: extensions, backups, sync services, download handlers and whoever else can reach the machine. A local-first product removes the application's upload path; it does not remove your obligation to decide whether this file may be opened here at all.
What this does not do
- Local processing is not a data-protection assessment, a lawful basis, or an approval to open a file.
- Bounded aggregates can still disclose. A distinct count of one on a rare category says something.
- Browser extensions, operating-system services, backups and download handlers lie outside the product boundary.
Do this in the studio
Decide whether the file may be opened on this device before you open it.
- Open the Import structure station only with a file you are permitted to handle.
- Review the observed aggregates before authoring anything from them.
- Confirm an example is safe to publish before it enters a folio.
Open the studio at the Import structure station