Privacy and your data#

This page is for laboratory heads, data stewards and research IT staff who want to know what Ingence does with a folder before it is allowed near one. It says what Ingence reads, what it writes and where, and when it uses a network. Where something is a limit rather than a promise, it says so.

In short#

Ingence runs entirely on your computer. No conclusion is reached by a language model or an outside service. It needs no account, no API key and no network connection, collects no telemetry, and sends none of your data anywhere. It fetches a public archive’s file list, or a pack file from a web address, only when you ask it to.

Ingence only reads the folders you point it at. It never moves, renames, deletes or changes a file in them, and it never runs a program it finds there. The only thing it adds to such a folder is a project folder, and only if you choose to keep the project inside it.
Once a folder has been read, everything Ingence does needs no network.
It uses the network only when you ask: to install the package, to fetch a public archive’s list of files, or to install a pack of words from a web address.
It writes into a project folder you choose, and nowhere else except a few named places listed below.

What it reads#

The census (ingence index) asks the operating system for each file’s name, size and dates, and for where each link points. It opens no file. It can be stopped at any moment. A stopped census publishes nothing and leaves the previous result in place.

The dive (ingence dive) opens files, read-only, within a time budget you grant. It reads headers, instrument clocks, text, tables and the member lists of archives. Readers that need it run in a supervised side process, so one damaged file cannot hang the run. It never runs a program it finds, and it recognizes an installed program by the names of its parts rather than by running it.

You choose how much of this happens. With --depth metadata, set once when the project is made, no dive opens a file. That declared depth is the default for the project and not a lock: a later ingence dive --depth standard or --depth deep overrides it for that run and does open files. Read someone else’s folder shows how.

What it writes, and where#

Ingence writes in four places and no others.

The project folder. This is where it keeps what it finds and what you decide: one folder per run (never edited afterward), your Record of decisions, your changes to the rules and the Dictionary, and your settings. You choose where it lives.
The system’s temporary folder, while it works.
Files you ask for, such as an export or a report. Ingence refuses to write one inside a folder the project reads.
A small settings folder for your user account. It holds the name you give the Dashboard so that decisions are signed, and a short list of the projects you opened recently. On macOS it is ~/Library/Application Support/Ingence, on Windows %APPDATA%\Ingence, and elsewhere ~/.config/ingence.

Keep the project outside the folder it reads. Ingence will accept a project inside the folder it reads, and every run then leaves the project’s own files out. But a project there puts its project folder inside that folder. That folder is the one thing Ingence ever adds to a folder it reads, and nothing else is written there. For a folder that is not yours, always put the project somewhere else.

A project holds the names of your files and short extracts read from inside them, such as text a dive kept. Treat a project folder with the same care as the folder it came from. Do not send it or a screenshot of it to anyone you would not show the folder to.

When it uses a network#

Ingence itself runs offline. It makes a network connection in three cases, each only when you ask.

Installing or upgrading the package, which your package manager does.
Fetching a public archive’s file list, with ingence index --fetch (Public archives). It sends one request at a time with a pause between them, says in its request what it is, and logs every request beside the list it fetched. If the archive answers “too many requests” or “service unavailable,” Ingence stops asking that archive for that run instead of retrying. Any other failure is recorded against that study and the fetch moves on. It fetches the list of files, not the files.
Installing a pack from a web address, with ingence teach pack install https://... (Domain packs). It is fetched when you run that command and never otherwise.

It sends nothing anywhere else. It does not check for updates and sends no usage data.

The Dashboard (ingence see) runs a small web server on the loopback address 127.0.0.1, which never leaves your computer. The pages it serves fetch no script, font or image from anywhere: everything ships with the engine, so it works with networking switched off. It refuses a write that comes from another web page open in your browser. It also refuses any request made to a name other than its own loopback address, so another web page cannot read it through your browser either.

There is one limit to know about. The Dashboard has no accounts and no sign-in. While ingence see runs, any program, and any person logged in to the same computer, can use it. That includes its landing page, which lists the folder names inside any folder that is typed into it, can make a project, and can start a first reading. Do not run ingence see on a shared server or workstation. Run it on your own computer.

When the folder is away#

A census and a dive need the folder, and they refuse a folder they cannot reach before they write anything. Everything after the first reading works from the project alone: re-reading names (index --rebind), infer, answering questions, and the Dashboard’s pages and its Re-run all work with a drive unplugged or a share unmounted. The Dashboard touches the folder itself in two cases only. The first is the first run it starts from its landing page, which lists the folder you name and then reads it. The second is the check behind the Graph page’s reorganization planner, which asks the disk whether the files in a plan are still there, their sizes and dates, whether a folder can be written to and how much room is free. It opens no file, and it answers “unknown” when the folder is away. The last finished result stays readable, because a run is published completely or not at all.

No model writes a conclusion#

Every conclusion Ingence reaches names a rule, written down in plain words, that anyone can read. No language model interprets your files, and none is needed to read what Ingence shows.

One optional part, the file-type detector (the detect part, not installed by default), is a trained program. It helps choose which reader opens a file. It only routes work, and it never writes a conclusion.

Short answers#

Question	Answer
Does it need a server or a database service?	No. It is a program you run, plus a page on your own computer while you use it.
Does it need an account anywhere?	No.
Does it change the folder it reads?	No. It reads names, sizes and dates, and with a dive it opens files read-only. If you keep the project inside that folder, the project folder is added there, and nothing else is written.
What does it send over a network?	Nothing, except the three cases above, each when you ask.
Does it send usage data or check for updates?	No.
Where does its output live?	In the project folder you choose, apart from the places listed under “What it writes.”

What this page does not promise#

Servers keep their own logs. Ingence changes no file on a share, but it cannot stop a server from recording that the share was read.
Cloud-synced folders (OneDrive, Dropbox, iCloud) may download a file that lives only in the cloud when anything opens it. The census opens no file. A dive does. Use --depth metadata on such a folder until you have checked what your sync client does.
Ingence’s conclusions are proposals and readings. They are not scientific conclusions, and they can be wrong. Many rules are still provisional.