Local-first, with the boundary written down

What this article describes

This is design intent, not a description of something you can use. Each capability or position it mentions, in its governed wording and with its status:

Clarni is designed to keep your work data on your own device, encrypted, with cloud AI only if you explicitly choose it.Status: Planned

Nothing you capture is sent to an AI provider until you trigger an AI action and have opted in to a cloud provider.Status: Planned

Clarni is designed so nothing is sent to an email, chat, or document system without your explicit confirmation immediately before it happens.Status: Planned

AI in Clarni is designed to retrieve, compare, suggest questions, draft, and propose; what it produces stays a proposal you can inspect and edit, and nothing goes to another system without your explicit approval.Status: Planned

This website collects only what you submit in the early-access request and the minimal technical data needed to run and protect the site; it is separate from what the future desktop app may store or process.Status: Design direction

“Local-first” is easy to say and easy to stretch. We would rather write the boundary down, in plain terms, so it can be checked against the product as it is built.

Where your work data is designed to live

Clarni is designed to keep your work data on your own device, encrypted, with cloud AI only if you explicitly choose it. Conversations, documents, decisions, commitments, and drafts are meant to stay there by default.

The two gates

There are two ways work data is designed to leave the device, and each needs a deliberate act from you.

The first is cloud AI. Nothing you capture is designed to be sent to an AI provider until you trigger an AI action and have opted in to a cloud provider. If you do choose one, the content you select for that action goes to that provider, and you are meant to see what will be sent before it goes.

The second is anything that reaches another person or system. Clarni is designed so nothing is sent to an email, chat, or document system without your explicit confirmation immediately before it happens. A draft is meant to stay a draft until you say otherwise.

What local-first does not mean

It does not mean offline-only. Choosing a cloud AI provider is designed to remain a legitimate option, and the design is meant to make that choice visible rather than impossible.

It is also not an absolute promise. We describe the boundary because a boundary can be inspected; a slogan cannot.

What AI is for, inside the boundary

AI in Clarni is designed to retrieve, compare, suggest questions, draft, and propose. What it produces is meant to stay a proposal you can inspect and edit, and nothing is designed to go to another system without your explicit approval.

This website is a different scope

Everything above describes the planned desktop product. This website is a separate matter, with its own, much smaller footprint: it collects only what you submit in the early-access request and the minimal technical data needed to run and protect the site. The privacy page describes the website in full, and keeps the two scopes apart on purpose.

Where this stands

The boundary described here is planned. Clarni is in development, and none of it is something you can use today. The labels beside this article show the status of each capability it describes.