Ilfirin runs on your own computer. Your wearable, food, and bloodwork data stays there — there's no Ilfirin account, no company database, and nothing sold. Privacy here is a property of how it's built, not a promise we ask you to take on faith.
One honest caveat, named plainly below: during a chat, tool results pass through Anthropic so Claude can read them.
Most health apps mail your records to a server you'll never see. Ilfirin does the opposite: it installs on your own machine and reads your data locally. Here's exactly what stays put — and the one path that doesn't.
The honest version: nothing is uploaded in the background, and there's no Ilfirin server in the middle. Data flows out only in the moment you ask a question — and only the slice that question needs. The two narrower modes below shrink or close even that path. Read the source: Anthropic's privacy policy.
The same coach, three levels of disclosure — a deliberate trade between AI quality and how much ever leaves your machine. Switch any time; it's a setting in your profile, not a support ticket.
| Privacy mode | Standard Full detail | Aggregated Summaries only | Local-only Nothing leaves |
|---|---|---|---|
| What Claude sees | Exact values, in full. ApoB 78 · RHR 51 · 156 lb | Summaries, not raw numbers. "cardio markers in range" · "stable" | Nothing reaches Anthropic at all. a local model reads it instead |
| What leaves your machine | Your message + the tool results it needs, during the chat. | Only the summary — raw values stay local and are never sent. | Nothing. A model on your own machine (Ollama) does the reasoning. |
| The trade-off | Best AI quality and the most granular coaching. | Still useful coaching; less precise where raw numbers would help. | Absolute privacy; AI quality is meaningfully lower than Claude. |
Standard is the default because most people want the best coaching. If you'd rather not send raw numbers, aggregated keeps them local; if you want zero data through Anthropic, local-only never lets a thing leave. It's your call, and you can change your mind.
Modes set the broad dial. Two more tools work underneath them: mark individual fields off-limits, and check, any time, exactly what was shared.
Orthogonal to the mode you pick — flag any single category as Claude-inaccessible, and only a pass/fail or a direction reaches the chat. Common choices:
Each tool call is logged to a plain file on your machine — which tool ran, which fields it returned, and what was redacted. Ask Ilfirin to show it any time; you control how long it's kept.
We'd rather lose you to the truth than keep you with a claim that doesn't hold up. So here's the connection, described accurately — the way a careful person would want it described to them.
It runs on your own computer. Your records live on your machine. We own no servers and keep no database of your health data — there's nothing for us to sell or leak.
No sign-up, no profile, nothing sold. There's no Ilfirin login, no analytics following you, and no business running on your data.
Tool results pass through Anthropic during a chat. On standard mode, that's how Claude reads your data to coach you. We link Anthropic's privacy policy and don't pretend otherwise. Aggregated and local-only narrow or close that path.
To let Claude reach your machine, the connection runs over standard TLS through a Cloudflare tunnel. That TLS is terminated at Cloudflare's edge — so the traffic is decrypted there before continuing. That means it is not end-to-end encrypted, and we will never call it that.
It's a standard reverse-proxy arrangement, and a common one. The honest takeaway: your data stays on your computer, but the chat path is ordinary web transport, not a sealed private tunnel. If that matters to you, local-only mode keeps everything on your machine.
Because Ilfirin runs on your machine and we run no service in the middle, a whole class of privacy problems simply doesn't exist here.
Tell us a little about your devices and your setup. We'll provision your own instance and send you a personalized installer — it runs on your machine, with the privacy mode set wherever you're comfortable. It's an early, invite-based beta, and access is limited while we keep it small.
An early beta — not a finished, polished product, and not pretending to be.