What data the app sends
Every payload in one table: what leaves your computer, when, where it goes and how to turn it off.
What data the app sends
Everything below is what the shipped code actually sends — the fields are named as the code names them, so this page matches what Settings → Telemetry and Review what will be sent show you. By default the app sends nothing: what leaves your computer is the model you chose to review with, plus whatever you switch on or press Send to.
| What leaves your computer | When it leaves | Where it goes | How to turn it off |
|---|---|---|---|
| The document text under review: the sections, tables and quotes the model reads, with the review instructions | When you run AI Analysis, when a file is prepared, and at Settings → Models → Check this model | Only the model provider you configured. A local model (Ollama or llama.cpp on this computer, or a server on your network) keeps it on your side; a cloud provider receives it under their terms. Automatos never receives document text from a review | Choose a local model. There is no second copy to switch off: the prepared text, the run log and the results stay on this computer |
| Pictures in a document | While a document is prepared, only when a Vision model is chosen | The Vision model's provider | Leave Vision unset in Settings → Models (off in the desktop apps), and keep Settings → Analysis → Advanced → Show the model the document's images off |
| Web search queries, made generic first: names of people and organisations, document numbers, e-mail addresses and paths removed | Only inside a run with Settings → Analysis → Web search on, when the investigator looks up a public fact | The search provider in Settings → Search: Tavily, DuckDuckGo, Brave Search, Google via Serper, or your own SearXNG instance | Keep Web search off, which is how it ships |
Telemetry counters — app_start: version, os, arch · run_finished: duration, doc_words, comments, model_family, provider_type · run_failed: error, model_family, provider_type · triage: by_tier, by_type, by_origin — how many comments you accepted, edited, rejected or rated, counted per tier, per comment kind and per the pass that raised it; accepted_after_edit and rejected_untouched say how many you kept after changing, or deleted without ever touching | Counted as it happens and queued on this computer; a day's events go out the day after that day ends, the next time the app sends | automatos.ca/docreview/api/telemetry, under a random install id you can reset | Settings → Telemetry → Off. Nothing at all is recorded until you choose a level; a lower level drops what it no longer records, and that tab lists every event waiting and can empty the queue |
A problem report (Help → Report a problem): report.json with created, description, email, level, attached, consent, app_version and, as you tick them, version, os, models, log as run-log-tail.txt and settings as settings.json; at With excerpts also run-log-full.txt; at With the document also document/ | Only after you press Review what will be sent and then Send. The preview shows every file, and a Send whose files no longer match that preview is refused | automatos.ca/docreview/api/report. A copy always stays in problem-reports/ in your app data folder | It never sends by itself: don't press Send, or pick Basic (only version and os). With no support address configured the zip only saves. With excerpts and With the document need the consent box |
A comment report (the ! on a comment): comment.json — the comment, its kind and tier, which pass raised it and its grounding verdict — plus report.json with comment_problem, comment_context and its run block (run_id, status, stage, error_code, started, finished, duration_s, note when this copy no longer knows that run, and models: one row per role with role, provider, model, provider_type, label, origin) and the same run-log-tail.txt and settings.json | When you press Send in the Report this comment dialog | The same report address as above | Only from the ! on a comment. It carries no document text, so there is nothing else to switch off; Add context data (the section and the passage it is anchored to) starts unticked and needs the consent box |
Debug-mode diagnostics: traceback.txt, run-events.jsonl, progress.jsonl, about.json, with the same log tail and settings, and report.json marked source with its debug facts (trigger, stage, error, error_code, hint, run_id, roles: each role's base_url as scheme://host only, never a path, query or key) | Automatically after every failure while Settings → Debug is on (1 h, 24 h or 7 days), at most 20 reports a day; each zip waits on this computer until it can be sent | The same report address as above | Settings → Debug → Off. It switches itself off when its period ends, and an automatic report never carries a document |
| An update request | At most once a day when the app starts with automatic checks on (Settings → General), or Help → Check for updates at any time | automatos.ca/docreview/updates/latest.json; installing then downloads the new package from automatos.ca | Automatic update checks off in Settings → General. Nothing installs without your click |
| The LibreOffice installer request | Only when you click Install LibreOffice | download.documentfoundation.org. Their mirror service can hand the bytes over from a third-party host, so the file's sha256 is checked against the digest published on the LibreOffice site itself before anything opens | Nothing downloads on its own, and DocReview never runs what it downloads |
| A licence activation: the key and a label for this computer | When you activate or deactivate a business licence key | The licence server (Lemon Squeezy) | Individuals and organisations of up to 5 people need no key, so nothing is sent |
The Support form on this website (not the app): name if you give one, email, topic (a question, a problem, a licence, something else) and message — nothing else, and never a document or an attachment | Only when you press Send on the Support page; at most five requests an hour from one address | One file on the same web server (automatos.ca/docreview/api/contact) and a card on Automatos' internal task board, seen only by the people who answer support there | Do not press Send: write to support@automatos.ca instead, or ask us to delete what already arrived (the stored request is deleted whole 365 days after it arrives) |
What never leaves your computer
Telemetry sends counts only: never document text, file names, comment text, settings or keys. A problem report at Basic or Standard has its document text, file names, comment text and API keys removed before it is built, and an update check or a download sends nothing beyond an ordinary web request. Your model providers get what you review with them, under their terms — Automatos does not read it, store a copy of it, or use anything you review to train a model. Nothing is sold or shared with third parties.
How long we keep it
Reports and telemetry arrive at automatos.ca/docreview/api (our server in Phoenix, Arizona, United States, so United States
law applies to what is stored there) and are readable by the server's administrator only. A report that carries document content
(With excerpts, With the document, or a reported comment) is deleted 90 days after it arrives; every other report after
365 days. Telemetry is kept in monthly files for usage analysis: it holds no personal data beyond the random install id, which you can
reset at any time. A new report opens a support ticket with its description, level, version and system — never with document content.
A request from the website's Support form (name if given, e-mail, topic, message) is kept
as one file and deleted whole after 365 days; its ticket on our internal task board stays.
Questions about your data
Access, correction or deletion: privacy@automatos.ca. Anything else about DocReview: support@automatos.ca or its Support form. Automatos follows Canada's privacy law (PIPEDA); see also our site-wide privacy policy. Free AI tiers may use what you send them for training — DocReview warns you before you pick one.