Built for documents you would never upload.
Here's exactly what “local-first” means, what never happens by default, and where PortableRAG's current limits are — in plain language.
Local-first by design
PortableRAG is designed so your documents and your questions stay on your computer. Processing happens locally using models that run on your machine, not on a server I operate.
What doesn't happen by default
- — Your documents are not uploaded anywhere.
- — No cloud account or API key is required to use the app.
- — No document content is sent to me or to a third party for the app to function.
Offline mode
Once your local models are downloaded and set up, PortableRAG can run fully offline. You control when and whether it connects to the internet.
You control your files
PortableRAG reads the files you add to a project; it does not move or replace your original documents.
What deleting a project does
Deleting a project removes the local data PortableRAG generated for that project — its search index and project-specific files. It does not delete your original documents. Your source files remain wherever you originally stored them.
This website's analytics and waitlist data
Everything above is about the PortableRAG desktop app. This section is about this website — a different, much smaller scope.
What the website collects, and why
- — Basic visit analytics: an anonymous, randomly-generated visitor id (stored in your browser, not tied to your name or email), which pages you viewed, which buttons you clicked, and where you came from (referrer / UTM campaign parameters, e.g. from a LinkedIn post link). I use this to understand what's working and where to focus — not to build a profile of you.
- — Coarse device info: browser, operating system, and device type (desktop/mobile), parsed from standard request headers. I do not use fingerprinting techniques to try to identify you across visits.
- — Country, when available from my hosting provider's edge network — I do not store your IP address to get this.
- — Waitlist details, only if you submit the early-access form: your name, email, operating system, profession, use case, whether you'd use PortableRAG for confidential documents, and any optional message — plus the same attribution info above, so I know which campaigns are actually driving sign-ups. This is stored so I can follow up about early access; it is never sold, and it is not shared beyond what's needed to run this early access program (e.g. an email provider to send you one confirmation email).
I do not use Google Analytics or invasive third-party trackers, and none of this analytics pipeline ever touches the contents of your documents — it has no access to them in the first place, since it lives on the website, not inside the desktop app. Analytics is only recorded when the site's analytics backend is enabled; with it off, nothing is stored.
Want your waitlist data deleted? Contact me via the Contact page and I'll remove your lead record, usually within 30 days.
Operational privacy details
The plain-language summary above is the important part. This section adds the formal details for the website's waitlist and analytics data (it does not apply to the desktop app, which keeps your documents local).
- Who's responsible (data controller)
- The individual developer of PortableRAG. A formal legal entity has not been established yet; this will be updated with the registered entity and address before public launch.
- Last updated
- July 10, 2026. Effective as of the same date.
- What's collected and why (purpose)
- Waitlist details are collected to run the early-access program and reach out about test builds. Basic first-party analytics are collected to understand what's working on the site. The specifics are listed in the section above.
- Legal basis (for EEA/UK visitors)
- Your consent, given when you submit the waitlist form, for waitlist details; and legitimate interest in understanding and improving the site for the limited first-party analytics. You can withdraw consent at any time by requesting deletion.
- How long it's kept (retention)
- Waitlist details are kept until you ask me to delete them or until the early-access program ends, whichever comes first. Analytics event records are retained for up to 24 months.
- Who processes it (recipients)
- Data is handled by a small number of infrastructure providers acting on my instructions: a website hosting provider, a managed database provider, and (only if you submit the form) an email-delivery provider for the confirmation email. Your data is never sold. It is not shared beyond what these providers need to run this program.
- International transfers
- These providers may process data on servers located outside your country, including the United States, under the data-protection terms in their respective agreements.
- Your rights
- You can request access to, correction of, deletion of, a copy of (portability), or object to the processing of your data. To exercise any of these, contact me via the Contact page. I'll respond within 30 days.
- Complaints
- If you're in the EEA or UK and believe your data has been mishandled, you have the right to lodge a complaint with your local data-protection supervisory authority.
- Marketing
- I only email you about early access and test builds — there is no separate marketing list, and you can opt out any time by replying to any email or asking me to remove you.
Honest limitations
PortableRAG is under active, early development.
- — It has not been independently audited or certified against standards such as HIPAA, GDPR, or SOC 2. It is designed for privacy-first, local use — that is a design philosophy, not a compliance certification.
- — Optional features that use cloud AI models (if and when you choose to enable them) will always be clearly labeled and opt-in.
- — Always use your own professional judgment when handling regulated or confidential information, and follow your organization's policies.
- — PortableRAG is not a substitute for legal, medical, or financial advice. Always verify important answers against the source and consult a qualified professional.
Questions about privacy or security?