Security
Return is a desktop app. Your documents are plain Markdown files in a folder on your disk, and the AI that reads them runs on your computer unless you turn on cloud mode. This page describes what runs where, what leaves your computer and when, and how to verify it yourself.
Two modes, two data flows
Local mode, the default
Local AI
Never leaves your machine.
- Your document Markdown on your disk
- Built-in engine Open model, runs inside Return
- Result in your editor Nothing leaves this box
Cloud mode, only if you turn it on (Pro)
Cloud AI
Not stored by us, never used for training
- Your document Sent only for the request you make
- Return proxy Our server in the EU, no content stored
- Anthropic Kept up to 7 days, then deleted. Not used for training.
- Result in your editor Switch back to local at any time
Local mode (the default, free)
- The AI engine ships inside the app and runs on your computer. It listens only on your own machine. There is no separate server to install.
- Documents, prompts and answers stay on your disk. Return works with the internet switched off once the models are downloaded.
- No account is needed. You sign in only if you upgrade to Pro.
- On its own, the free app makes one network call: an unauthenticated update check that sends your app version and platform, counted only as daily aggregates. You can turn it off in Settings. The only other time it contacts our server is when you send a support request from Settings, and you see exactly what it sends before you press Send. See Privacy Policy §2.
Cloud mode (Pro, you switch it on)
- When you turn cloud mode on in Settings, the content you ask about is sent for that request to Return's proxy server and from there to Anthropic. The proxy keeps server logs for at most 7 days and does not store your content.
- Anthropic retains requests for up to 7 days for abuse monitoring, then deletes them. Your content is not used to train models. Transfers to the USA rely on EU Standard Contractual Clauses and the EU-US Data Privacy Framework.
- You can switch back to local mode at any time. The switch takes effect on your next message.
- Pro sign-in uses a one-time code sent to your email. There is no password to create or store.
Retention
| Data | Where | Kept for |
|---|---|---|
| Your documents and chat history | Your computer | Until you delete them |
| Cloud requests (Pro) | Anthropic, USA | Up to 7 days, then deleted |
| Proxy server logs (Pro) | Hetzner, Germany | Up to 7 days |
| Account email (Pro) | Supabase, EU region (Frankfurt) | Until contract termination, plus 30 days for download |
| Billing and invoices (Pro) | Paddle, United Kingdom, as Merchant of Record | 5 years from the end of the tax year (Polish Tax Ordinance) |
Retention periods follow Privacy Policy §4. The full list of processors, with locations and transfer safeguards, is on the Subprocessors page.
How to check that it runs locally
- Look at the status bar at the bottom of the window. In local mode it shows the mode and the model, for example Local · Qwen3.5 9B.
- Open Settings → AI. The toggle shows whether Local or Cloud is active. A switch takes effect on your next message.
- Turn off Wi-Fi and keep working. Local mode does not need a connection.
The app sends no telemetry
The desktop app has no analytics SDK, no crash reporting without your consent, no fingerprinting and no advertising trackers. The website returneditor.ai sets no tracking cookies and loads no third-party analytics scripts. Ad-conversion measurement on the website happens only with your consent in the EU, EEA and UK. Details and your choices are in the Privacy Policy.
Signed builds
- macOS builds are notarized by Apple and signed with a Developer ID certificate.
- Windows builds are signed and timestamped with a publicly trusted code signing certificate.
- Updates are signed bundles downloaded from
cdn.returneditor.ai.
Reporting a security issue
Email [email protected]. Data-protection requests go to [email protected]. The operator is Michał Jantos, a sole proprietorship registered in Poland; the registered address and registry details are in Privacy Policy §12.