What the model sees and never sees
Review the fields and sample records your consultant will use in the sharing screen. The information you permit is used to answer your question.
Information is checked before it leaves your device and before it reaches your consultant. If the check cannot finish, it is not sent.
- Computed results travel with an evidence id that shows their origin; a result without one is refused.
- Your full table cannot be sent as a calculation result.
- Content that exceeds the permitted sharing scope is not sent.
- Information is checked on your device and again before it reaches your consultant.
Every number is verified before it is shown
Calculations run on your own device, using your data. Numbers in the answer are checked against those results.
- Every number in the answer is linked to a source.
- A number that does not match its source is not shown as verified; the answer is corrected.
- The numbers in the answer are filled in from verified values; no other number without evidence can remain in the text.
- If the data changes or the analysis is cancelled, the stale result is not published.
Identity fields are counted, not listed
Identifiers such as user ids or UUIDs, and coordinates, are recognised when the data is profiled. Tools only count these fields: their values are not listed and nothing is grouped by them.
- A request to group by an identifier is refused by the tool.
- Calculations such as distinct people or distance use these fields on the device, in the data and calculation engines; only the result reaches the model.
Sample records are real, unmodified records, so an identifier field can appear in them. You see the samples on the approval card. If you do not want a field’s values shown, choose “Do not show its values” for that field.
Extra restrictions are your choice, off by default
Before the first question on each source, an approval card opens. It shows the fields and sample records that would reach the model. Nothing is sent to the model until you answer.
Basic sharing checks always apply. As the data owner, you choose any additional restrictions. Each field has three options:
- Show: the default; the field is used as usual.
- Do not show its values: the field’s values do not appear in the samples or field details; calculations still use it and their results reach the model.
- Do not use at all: the field is used in no calculation; only its name reaches the model.
The Advanced section has two more options; both are off by default:
- Hide small groups: groups smaller than 5 records (or protected units) are not sent.
- Keep a privacy history: results that would reveal a small group when combined with earlier ones are not sent. This option also turns on small-group hiding.
You can change your choice at any time from the source’s “Model sharing settings” link. A choice made for a nested field also applies to the fields inside it.
The privacy history stays on your device
When you turn on the privacy history, every result sent to the model from a source is written to that source’s history. A new result that would reveal a small group together with earlier ones, for example by subtracting a subset from a total, is not sent.
- The privacy history has no cloud copy; it is kept only on your device.
- In the browser it is encrypted under a non-extractable device key.
- When the local XENTHK app is paired, it holds the authoritative privacy history: records are encrypted again, the key sits in the operating system keychain and records are hash-chained.
- If truncation, tampering or rollback is detected, the history is marked as lost and no new results are sent from that source.
Limit: if the local app is not paired and the browser’s data is cleared, a wiped history cannot be told apart from a first open. This protection holds only while the local encrypted history is intact.
Your information is used only for as long as needed
Requests to your consultant pass through XENTHK. Calculations continue to run on your own device.
- The request content is used while preparing the answer; it is not stored permanently or written to activity logs.
- The server applies the browser’s transport guard again before calling the provider.
- Activity records support usage and error tracking; they do not include your messages or calculation results.
- Usage counters linked to your account are stored to enforce quotas.
What reaches the provider is subject to that provider’s retention and processing terms.
Connection keys are encrypted
- The local XENTHK app keeps keys for data-source connections (such as analytics platforms), as you choose, for this session only or in the operating system keychain; the keys are not backed up to the cloud.
- Some connections use your password only at sign-in. Others keep it for the session or in your device’s secure credential store, according to your choice.
- Model provider and service keys you save in the panel are encrypted before they are written to the database.
- Settings screens get back only a masked hint, never the key itself.
Honest limits
- Text you type or paste into a message goes to the model as written; its content is not checked. Do not paste passwords, keys or personal records into a message.
- A numeric summary is not anonymisation. A result such as a minimum, maximum or median can reveal a single observation.
- Sample records carry real values. The approval card shows what will be sent; restrict it per field when needed.
- Information that reaches the model is subject to the terms of the provider you choose.
- This page explains the current protections and their limits; it is not a certification or independent audit claim.
For legal details, sessions, cookies and team access, see the Privacy page. Privacy
Last updated: 26 September 2026