A private place to think.

No account. No cloud inference.

The app includes no accounts, ads or telemetry. Chats, drafts, project instructions, imported models and sources are stored in the app’s private storage. Local inference does not send prompts or model responses to a remote inference service.

Model downloads and optional assets use the network when you choose to acquire them. Their providers can receive ordinary connection information, including your IP address. Offline-only mode blocks new external app requests and cancels or suspends outstanding transfers, including after restart.

Conversations and sources.

Regular chats and project material are saved locally. Temporary conversations stay in memory, are not added to durable transcripts, and clear when the app backgrounds, except when returning from the initiated photo picker. A hard process stop can lose the most recent unsaved checkpoint of a regular response.

Sources are scoped to their projects. Deleting a source removes its private original and extracted/indexed content. Historical references show when the original is gone. Deleting a model removes its weights while keeping conversation history.

Backups, exports and app lock.

Automatic cloud backup and device transfer of private app data are disabled. User-triggered backups use AES-256-GCM authenticated encryption with PBKDF2-HMAC-SHA256 and a passphrase. The current format excludes model weights and original source binaries; keep those files separately. Keep your passphrase safe.

Markdown and JSON conversation exports are plaintext. Deleting information in Fieldwork does not delete copies you exported elsewhere. Optional biometric or device-credential app lock restricts access through the interface; it does not independently encrypt the Room database or model files. Screenshots and app previews are allowed in this build.

Optional voice, images and local API.

Dictation uses Android’s explicit on-device recogniser where supported; read-aloud filters for offline voices. Offline language assets and availability depend on your Android system. Fieldwork does not silently fall back to an online speech recogniser.

Images are reduced in size and re-encoded without original EXIF metadata before storage or local inference. A supported multimodal model and matching projector are required. OCR runs locally with separately acquired language data.

The optional authenticated API is off by default, binds to IPv4 loopback on the same phone, and stops when the app backgrounds. It uses a revocable token, does not listen on your LAN, and shares the same model session as the app.

Diagnostics and practical limits.

Diagnostic exports omit prompts, responses, passages, filenames and credentials by default. They include technical metadata such as app/Android versions, model hashes, engine revision and numeric settings. Review any file before sharing it.

Local models can produce inaccurate answers. Device memory, battery and thermal limits affect what runs well. Build and host/JVM checks are recorded for this release; emulator and physical-device acceptance tests are not recorded.

This website and secure downloads.

The presentation pages load local styles, scripts and images. This site includes no third-party advertising or analytics scripts. Your hosting provider may record ordinary web access and error logs, including IP addresses, request paths and timestamps, under its own retention settings.

The download flow sets a necessary, HTTP-only session cookie to bind verification and the download permission to your browser. It is a session cookie rather than a marketing identifier. Server session files can remain until PHP’s cleanup runs; this site configures a 30-minute session garbage-collection lifetime.

When secure downloads are enabled, the download page loads Cloudflare Turnstile to check for automated requests. Your browser connects to Cloudflare, which processes security signals. The server sends your verification token and connection IP to Cloudflare for validation. The app itself does not use Turnstile.

The download service uses keyed hashes of connection IP addresses for rate limits. A bounded local ledger drops expired records on the next verification or download request; the longest configured window is 24 hours. Raw IP addresses are not stored in that ledger. Hosting logs are separate.

Download permissions expire after two minutes and work once. They reduce automated abuse and link sharing; they cannot prevent someone from redistributing an APK after downloading it.

About Fieldwork.

Fieldwork is a Retrace Enterprises application. Visit Retrace Enterprises for organisation information.