Your review stays on your device.

No password-based cloud account. Collaborating with another reviewer is optional and, through our server, carries only encrypted content.

On the device

Records, attachments and license verification stay local, except what a review with collaboration turned on syncs (see Collaboration). Compendium does not encrypt the database, attachments or exported packages: turn on BitLocker or Windows Device Encryption, keep backups and avoid identifiable participant data.

Local AI

The optional AI talks only to the Ollama you run on your computer, with consent per task.

Network

The app checks a signed update manifest and, when a licensed user opens Settings, the signed manifest of the optional R statistics module (one switch turns both off). Otherwise the network is used only when you ask: downloading an update or the R statistics module, opening a link or downloading a model in Ollama. In a review with collaboration on, the app also contacts our server about once a minute while that review is open. Only sync carries review content, always end-to-end encrypted.

Website and email

Cloudflare handles ordinary request metadata when serving the site. The contact form writes the email in your browser; nothing is sent to this site.

Collaboration

Off by default and turned on per review, for two people, after your specific consent. Your decisions and a copy of the review without anyone's decisions leave your computer encrypted, are stored in the European Union and are deleted by a daily sweep once they are 90 days old. If you leave or delete your server data, batches already sent stay for up to 30 days after that, and never more than 90 days from upload. The server keeps neither your IP nor your email in plain text, but it sees metadata such as when you sync and who works with whom. What your colleague received stays on their computer. Without the server, use the review package. Compare the safety code with your colleague.