Overview
Thumper-Run is built on a simple principle: your data is yours. The desktop does not upload browser analytics events. The web shell accepts a bounded anonymous event category only after the account privacy preference is loaded and permits it. This page provides a transparent, technical breakdown of exactly what is and isn’t collected.
What We Collect
Desktop App (Tauri)
The desktop application has no browser-telemetry HTTP flush path. When telemetry is enabled by its release configuration, activity and error diagnostics may be recorded in the local device document and native tracing may be exported only through an explicitly configured operator OTLP pipeline. Sync, account, catalog, update, connector, and cloud features can contact their configured services; local inference alone does not imply that every workflow is network-silent.
Web Shell (thumper.run)
The web shell collects limited data in specific environments only:
| Data | Tool | Environment | Purpose |
|---|---|---|---|
| Anonymous page views | Bounded telemetry intake + OTLP | Production only | Understand which docs pages are useful |
| Server diagnostics | Operator-configured OTLP | Deployment dependent | Diagnose service failures without accepting raw browser errors |
What We Don't Collect
The following data categories are never collected, transmitted, or stored by Thumper-Run:
| Category | Examples | Guarantee |
|---|---|---|
| Model prompts | Chat messages, image prompts, system prompts | Never leaves device |
| Generated content | Images, audio, video, LLM responses | Never leaves device |
| File contents | Documents, code, uploaded files | Never leaves device |
| Model weights | GGUF, safetensors, ONNX files | Never leaves device |
| Chat history | Conversations, threads, context | Never leaves device |
| API keys | HuggingFace tokens, Ollama endpoints | Stored in OS keychain only |
E2EE Design Status
Private end-to-end encryption is planned and is not a current release guarantee. Supported connections use encrypted transport, while current relay-assisted sync and deployment workflows remain server-assisted.
ChaCha20-Poly1305 and BeeKEM/CGKA primitives exist in the codebase, but shipping-client custody, admission, rotation, persistence, and release evidence remain gated. Their presence does not make the current service zero-knowledge or prove private E2EE.
Opt-Out
Desktop App
The desktop has no browser analytics upload. Disable Analytics in Settings → Privacy to stop local telemetry event recording as well. Networked product features have their own controls and are not reclassified as analytics.
Web Shell
- Go to Settings → Privacy and disable Analytics; the runtime gate changes immediately
- On a new browser load, analytics remains off until the authenticated privacy response explicitly permits it
- If that preference cannot be loaded, the telemetry gate stays closed
Data Retention
Thumper-Run retains minimal data with short lifetimes:
| Data Type | Retention | Deletion |
|---|---|---|
| Sync ciphertext | Until you delete your account or revoke all devices | Automatic on account deletion |
| Server diagnostic traces | Operator policy | Controlled by the configured OTLP backend |
| Browser event categories | Operator policy | Bounded labels only; no client properties or session id exported |
Server-side account, billing, deployment, catalog, support, moderation, and encrypted sync records are retained according to their product and legal lifecycle. The anonymous telemetry intake is not an identity or behavioral-profile authority.
Open Source
Every line of Thumper-Run code is open source and auditable on GitHub. You can inspect the desktop, sync, telemetry, and web-shell implementations and compare them with the documented release boundaries. Open source code supports review; it is not by itself proof of a private E2EE claim.
We believe transparency is the strongest privacy guarantee. If you find any discrepancy between this page and the actual code, please report it via security@thumper.ai.
Key Takeaways
- Local-only workflows keep data on the device until you enable a network feature
- Cloud, sync, and telemetry paths have separate explicit controls and disclosures
- Private E2EE remains planned; current relay-assisted workflows are server-assisted
- Web shell: bounded anonymous event categories flow through the configured OTLP backend only after preference admission
- Opt out through Settings → Privacy; preference-load failure stays off
- All code is open source and auditable