Where your data goes
Last updated: 2026-09-18. This page is the complete list, checked against the software's code on that date. It changes when the software does, and each change is noted in the changelog.
Peribolos is local-first. Your clients, sessions, invoices, the clinical record, your process notes, your recordings and their transcripts live in files on your own computer. There is no Peribolos server that holds your practice.
A small number of things can leave your machine. Every one of them is listed below: what is sent, to whom and where, when, and how to turn it off. If a feature is off, its row sends nothing.
The short version
- Nothing about your practice is uploaded anywhere by default. Your own name and email, given at setup, are sent to Peribolos once.
- The one flow that carries note content off your machine is a session being workshopped or a Workshop message, and it goes de-identified: your registered clients' names, dates of birth and contact details are removed first, and a final check refuses the send if an email address or phone number is still in the text.
- Recordings are transcribed on your own machine. Audio is kept for 90 days so a line can be heard again, or 30 if a client asks, then deleted. Transcripts stay on your machine like any other note.
- The optional integrations (calendar, email, SMS, payments, bank matching, bookings) each carry identified information to the provider you connect, and each has its own switch.
- Three things happen on their own: the app checks for updates, the first time you transcribe it downloads the speech model, and once a day it sends a random install number, its version and the dates the AI features were used, to show it's in use (on unless you turn it off; an install that never chose starts only after a one-time notice). None of them carries anything about your practice.
- A strict local mode switch (Office → Settings → Privacy) refuses every AI send whose destination is not this computer.
What never leaves
- The two databases: the practice (clients, sessions, invoices, the clinical record and its audit trail) and the working space (process notes, reflective notes and the workshopped sessions).
- Recording audio and transcripts. Transcription runs on your machine. Speaker labelling runs on your machine too, with a model that ships inside the app, so no account with anyone is needed for it.
- Your settings, keys and backups.
These files are readable only by your own computer account. Disk encryption (FileVault on a Mac, BitLocker on Windows) is what protects them if the machine is lost, and that is yours to switch on.
What can leave, and when
| Flow | What is sent | To whom, and where | When | Off switch |
|---|---|---|---|---|
| Workshopping a session, or a Workshop message | Note or transcript content, de-identified first: registered clients' names, dates of birth, phone numbers, emails and addresses are removed; email addresses, phone numbers and Medicare or NDIS numbers belonging to anyone are pattern-removed; a final check refuses the send if an email or phone number remains. Your practitioner profile and clinical orientation ride along as framing. | Anthropic (Claude), processed in the United States. With a Peribolos AI key the request passes through the Peribolos relay (Fly.io, Sydney) on the way: the relay forwards it, keeps no copy of the content, and records the date the key was used and the cost of the call. With your own key it goes to Anthropic directly. You can point the app at another provider, or at a local model, in which case nothing leaves. | Only when you press Workshop it, or send a Workshop message. | Strict local mode (Settings → Privacy) refuses it. Or run a local model. |
| Dictation tidy-up (optional) | The dictated transcript, with structured identifiers removed but spoken names left as spoken (a name said aloud is not a record the remover can match). By default this never leaves your machine: the tidy-up runs on a local model or is skipped. | Your AI provider, as above. | Only if you have deliberately switched cloud tidy-up on in the configuration file. | It is off unless you turn it on. |
| The Claude Code connection (optional setup step) | Whatever you ask Claude Code for, read straight from your practice database: identified, real names and notes. This is the one path where identifying material can reach an AI, and strict local mode does not cover it. | Anthropic, through your own Claude Code account. | Only if you complete that optional step, then only when you ask Claude Code something. | Remove the practice database from your Claude Code configuration. |
| The speech model download | A request for the model files, once. Carries your computer's address and the model name. Nothing about your practice. | Hugging Face (United States) for the speech-recognition model; PyPI for the optional speaker-labelling packages if you choose to install them. | The first time you dictate or transcribe; again only if the model is missing. | Do not use dictation or recording. |
| Update check | A request for the current version file, then the update itself. Nothing about your practice. | sebkitchentherapy.com/downloads, hosted on GitHub Pages (GitHub, United States). The installer itself is on GitHub Releases. | At launch and on a timer while the app is open. | There is no switch for it yet. |
| Getting a Peribolos AI key | Your name, your email, whether you are practising or studying, and how you heard about Peribolos. | The Peribolos relay (Sydney). Kept in the relay's ledger and its server log, to reach you and to count on how many days each key is used. | Only when you request a key on the key page. | Use your own Anthropic key instead. |
| Plans and payment (from 2027) | A random install id, so the relay can hand the app its licence. Your card details go to Stripe on Stripe's own page and never to Peribolos. | The Peribolos relay (Sydney); Stripe (United States). | Only if you start a purchase; then a daily licence refresh while a plan is held. Nothing is sent during the free period. | Do not buy a plan. |
| The founding members list | Your name and plan, only if you tick the box. | Shown on peribolos.app/founders, read from the relay. | Only if you choose to be named. | Leave the box unticked. |
| In-app feedback | What you type, up to three screenshots (check them: a screenshot of the app can show a client's name), the technical summary shown under "what is attached", and the email your key was issued to. | The Peribolos relay (Sydney). | Only when you press Send. | Do not press Send. |
| Resource links (optional, per client) | The resources you tick for one client: their titles, descriptions, files and links, and your practice name, published at a random link. Not the client's name or anything about them; which client a link belongs to is recorded only on your computer. The text is checked against your client list and refused if a client's name appears in it. Anyone with the link can open the page. | The Peribolos relay (Sydney). | Only when you create a link on a client's Resources tab. | Turning the link off removes the page. Refused under strict local mode. |
| Your name and email (required at setup) | The name and practice email you gave at setup, with a random install number and the app version. Nothing about your practice or your clients. | The Peribolos relay (Sydney). | Once after setup, and again only if you change either. Never in the demo. | Required: Peribolos asks every practitioner for them. |
| Sharing how you move through Peribolos (opt-in, off by default) | Which screens you open and which buttons you press: the minute, the room, the screen's and the button's names. Never anything typed, never a client's name or details. With a random install number. | The Peribolos relay (Sydney). | Once a day, only if you tick it at setup or switch it on. Never in the demo. | Untick it under Settings → Privacy & security → Usage and diagnostics. |
| Daily usage signal (on unless you turn it off) | A random install number made on your computer, the app version, and the dates on which the AI features were used here (only the dates: never what was written, which feature or for whom). The relay keeps the number, the day, the version and those dates. Nothing about your practice. The number stays the same, so it is random, not anonymous: if you buy a plan, the purchase is filed under it. | The Peribolos relay (Sydney). | At most once a day. New installs choose in setup (the box is ticked). An install that never chose sends nothing until the Office has shown a one-time notice. The dates go only once a notice naming them has been shown; an install that saw the earlier notice is shown the new one once. Never in the demo. | Turn off on the notice, or Settings → Privacy & security → Usage and diagnostics. |
| Crash reports (opt-in, off by default) | When the app itself hits an error: the error type, its message, and the stack (the lines of code it passed through), with the app version. Client names, email addresses, phone numbers and home-folder paths are removed first, by the same de-identification the Workshop uses; a report that can't be de-identified is not sent. No local variables, no log history, no computer name. An error message can quote what the code was handling when it failed, so a fragment of other text can ride along; every text in a report is cut to 300 characters. | Sentry (United States). | Only if you switch it on, and only when an error occurs. The Office asks once, with Turn on and Not now; Not now leaves it off. A build with no crash-report destination sends none. | Settings → Privacy & security → Usage and diagnostics (the switch appears once there is a destination). |
| Google Calendar (optional) | Session times and the client's name in the event title; the client's email too if you turn on invitations. | Google (United States). | Only if you connect Google Calendar. | Settings → Calendar. |
| CalDAV calendar (optional) | Session times and the client's name. No emails; no invitations on this provider. | The calendar you connect: Apple iCloud, Fastmail, Nextcloud or another CalDAV server. Where it is processed is theirs to state. | Only if you connect one. | Settings → Calendar. |
| Calendar feed (optional) | Session times and client names as a read-only feed served from your own machine. Nothing is pushed anywhere. | The calendar app you subscribe with then holds a copy wherever that app syncs. | Only if you switch the feed on. | Settings → Calendar. |
| Email reminders and welcome emails (optional) | The client's name and email, and the message. On a Mac, reminders and welcome emails open as a draft in Mail for you to send; nothing is sent for you. | Your own email provider. | Only if you enable email. | Settings → Integrations. |
| SMS reminders (optional) | The reminder text and the client's mobile number. | BurstSMS, an Australian provider. | Only if you enable SMS. | Settings → Integrations. |
| Payment links on invoices (optional) | The invoice amount and reference. The client enters their card on Stripe's page. | Stripe, through your own Stripe account. | Only if you connect Stripe. | Settings → Integrations. |
| Bank matching (optional) | Peribolos reads transaction lines from the one account you connect. Payer text on a deposit can carry a client's name; those lines stay on your machine like a CSV you upload. Nothing is sent. | Basiq (Australia), or a SimpleFIN bridge you subscribe to (Redbark is the worked example). | Only if you connect one. | Settings → Bank feed. Refused under strict local mode. |
| Online bookings (optional) | Peribolos reads bookings from your Cal.com account, including the person's name, and files them as enquiries. Nothing is written to Cal.com. | Cal.com, with your own key. | Only if you connect it. | Settings → Online bookings. |
| Website enquiry forms (optional) | Peribolos reads your own mailbox for form submissions and marks them read. Nothing is sent anywhere; the mailbox is yours. (An older path reads a Google Sheet you authorise instead.) | Your email provider, or Google. | Only if you connect it. | Settings → Website form import. |
If you enable none of the optional rows and never press Workshop it, the only requests the app makes are the update check and the one-time speech-model download.
The Peribolos relay, plainly
One small server on Fly.io in Sydney. It forwards AI requests for people using a Peribolos AI key and keeps no copy of what passes through; it records the date each key was used and what the call cost. It issues keys, holds feedback you send, hosts the resource-link pages, keeps the founders list and the daily usage signal's ledger. It never holds your clients, sessions, notes or records; the software has no way to upload them.
Who else handles anything
| Provider | What for | Where |
|---|---|---|
| Anthropic | Processes de-identified workshopped sessions and Workshop messages. Its commercial terms forbid training on what is sent through the API. | United States |
| Fly.io | Runs the Peribolos relay. | Sydney, Australia |
| GitHub | Hosts the installers, the update files and this website. | United States |
| Hugging Face | Serves the speech-recognition model, downloaded once. | United States |
| Sentry | Receives crash reports, only if you opt in. | United States |
| Stripe | Peribolos's own billing once paid plans open; your card never reaches Peribolos. | United States and global |
| Plausible Analytics | Counts visits to peribolos.app: page views and two clicks, no cookies, no personal data stored. The app itself sends nothing to it. | European Union |
| Google Fonts | Two typefaces on peribolos.app. That request carries your address to Google. The app itself does not load them. | United States |
This website
peribolos.app is static pages on GitHub Pages. It loads two typefaces from Google Fonts, and it counts visits with Plausible Analytics: page views, the page you came from, your country, and two clicks (download and demo). Plausible sets no cookies, stores no personal data and is hosted in the European Union; your address is used only to tell one visit from another within the day and is never stored. The founders page reads its list from the relay. Downloads come from GitHub Releases.
How releases are signed
Mac builds are signed with an Apple Developer ID and notarised by Apple. Updates are checked against a signing key built into the app before they are installed. The Windows installer is not yet signed, so Windows shows an "unknown publisher" warning; the download page says so.
Reporting a security problem
Email contact@peribolos.app with a plain description. Never include session content, transcripts, recordings or a client's details in a report. Describe what happened, or send a screenshot with the content covered. A machine-readable contact is at peribolos.app/.well-known/security.txt.
Your side of it
You are the holder of the clinical record, and the obligations that go with it are yours: your privacy notice to clients, the disclosure of any overseas processing you enable (Australian Privacy Principle 8), and notification if a device holding the record is lost or breached. Peribolos holds no copy of your data and cannot notify on your behalf. The full privacy and data-handling document is at peribolos.app/privacy.