Effective date: January 1, 2026 · Last updated: October 10, 2026
Summary: By default, DeCiphr stores all your data locally on your device, and the developer cannot see it. Creating an account is optional. Cloud sync is not yet enabled; once it launches, if you choose to sync between the DeCiphr mobile and web apps, your coded data and project metadata will be uploaded to your own private DeCiphr account so both apps can share them. DeCiphr never stores your photographs on its servers or in your account. DeCiphr itself sends an image off your device only when you run an analysis. When you run an AI analysis, your image is sent to Anthropic solely to perform the analysis; per Anthropic's API policy it is not used for training and is automatically deleted within about 30 days.
This Privacy Policy explains how DeCiphr — the research platform at deciphr.tech, comprising the web application (app.deciphr.tech) and the mobile application, together referred to here as "the app" — developed by Salem M. Alajmi ("the developer"), handles your information. DeCiphr provides AI-assisted visual analysis, designed for researchers across the humanities and social sciences. This policy applies to both apps.
By using DeCiphr, you agree to the practices described in this policy.
When you use DeCiphr without an account ("local mode"), all of the following is stored exclusively on your device using local storage. None of it is stored by or accessible to the developer:
Local mode has no cloud backup: Your data is stored only on your device and cannot be recovered if your device is lost, reset, or damaged, or if your browser's data for DeCiphr is cleared. Back up regularly: in the web app, Settings → Data & Backup → Download Backup (photographs are not included, so keep your original photo files); in the mobile app, Settings → Export all projects (Excel) and Settings → Export Photos (ZIP).
Cloud sync is not yet enabled. You can create an account today and it will be ready when sync launches. For now, your projects, codings and photos stay on your device. Your account holds your email address, name and institution, and any framework you publish (see below). This section describes what will be uploaded once sync is turned on.
Creating a DeCiphr account is optional and turned off by default. When you connect an account in the mobile app, it first shows a notice explaining how your data will be handled. Nothing is synced until sync launches.
If you create or connect an account, the following are uploaded to your own private account in DeCiphr's cloud database so the mobile and web apps can share your work:
Only the coded data and metadata above are synced.
This data is stored solely to provide the sync feature and let you access your work across devices. It is not sold, shared with third parties, or used for advertising or for training AI models. Cloud hosting and database services are provided by Supabase, acting as a data processor on the developer's behalf. Access is protected so that only you, signed in to your own account, can read or write your data. Account emails (sign-up confirmation and password reset) are sent through Resend, also acting as a data processor on the developer's behalf. Resend receives your email address only to deliver these messages and keeps a record of each message for up to 30 days.
DeCiphr includes a public framework library. Publishing is separate from sync, and it works today. If you are signed in and you publish one of your frameworks, that framework is uploaded to DeCiphr's server and is visible to everyone using the app: its name, description, discipline, codes and definitions, master prompt, and references. Your own details are not included unless you choose to include them: when you publish, the app asks whether to publish your creator details (name, institution, and, on the mobile app, email address, ORCID, and website) with the framework, and publishes without them if you decline. Nothing else is published — no photographs, codings, projects, or memos. Only you can remove a framework you published, from the framework library screen in either app.
You can stop syncing at any time by signing out (your synced data remains in your account), or you can request deletion of your account and all associated cloud data by contacting the developer (see Section 11).
When you run an AI analysis in DeCiphr, the following is transmitted to Anthropic's servers via the Claude API:
This transmission occurs solely to perform the analysis and return the result to your device. According to Anthropic's API usage policy, images and inputs sent via the API are not used to train Anthropic's models and are automatically deleted within about 30 days, with limited exceptions for legal compliance and abuse monitoring.
Analysis requests pass through DeCiphr's relay, hosted on Cloudflare, which forwards them to Anthropic and returns the result. The relay does not store images.
Corpus chat (web app): if you use the corpus chat, your question and the open project's coded data are sent to Anthropic through DeCiphr's server, hosted on Netlify, to produce the answer. That data is the project name, the framework's code names, and each item's admin number or file name, codes and languages; for projects of up to 100 items it also includes transcriptions, translations and GPS coordinates. No images are sent. The same Anthropic terms apply.
For full details, refer to Anthropic's Privacy Policy: anthropic.com/privacy
When you take a photo inside the mobile app, DeCiphr asks for permission to use your device's location and records where the photo was taken. For photos you import, it reads the location stored in the photo's own data, where there is one. The location (latitude and longitude) is kept on your device alongside the image. It is not sent with the image when you run an analysis, and it is not used for tracking, advertising, or analytics. If you use the corpus chat in the web app, the coordinates of the project's items can be included in what is sent to Anthropic (see Section 4). Once cloud sync launches, if you turn it on, your coordinates will sync to your own account so the same field data is available across your devices.
When you open a map inside DeCiphr, the map images come from a map provider (OpenStreetMap, or MapTiler where a key is configured). To send those images, that provider necessarily receives the area of the map you are looking at, in the same way any website with a map does. Your photographs, codings, and the coordinates stored with your items are not sent to the map provider.
DeCiphr requests access to your camera and photo library solely to allow you to capture or import images for analysis. The app does not access your photo library beyond images you explicitly select. Photographs are stored on your device. DeCiphr never stores them on its servers or in your account: when you run an analysis, the image passes through DeCiphr's relay to Anthropic without being kept. If your phone's own backup (iCloud or Google) is turned on, it may include photos stored in DeCiphr, as it does for other apps. DeCiphr has no access to that backup. If your ethics approval restricts cloud storage, exclude DeCiphr from your phone's backup or turn backup off.
Whether you use local mode or an account, DeCiphr does not include third-party advertising SDKs or analytics SDKs, does not sell or share your data, and does not use your content for advertising or AI model training.
In local mode, the developer has no access to your images, analyses, frameworks, location data, or memos. Once cloud sync launches, if you turn it on, the coded data and metadata listed in Section 3 will be stored in your private cloud account, accessible only to you when signed in; the developer will not use this content for any purpose other than providing the sync feature.
If you submit your email address via the waitlist form on the DeCiphr website (deciphr.tech), that email address is collected and stored by Netlify Forms solely to notify you of future updates. It is not shared with any third party and will only be used for DeCiphr-related communications. You may request removal at any time by contacting the developer.
DeCiphr is designed for use by researchers and is not directed at children under the age of 13. The app does not knowingly collect personal information from children.
If this privacy policy changes materially, the updated version will be posted at this URL with a revised effective date. Continued use of the app after any changes constitutes acceptance of the updated policy.
You can request deletion of your DeCiphr account and all associated cloud data at any time. To make a request, email s.m.f.alajmi@pgr.reading.ac.uk from the email address linked to your account, using the subject line "DeCiphr account deletion request".
On a verified request, we will permanently delete your account, your email address, and all coded analysis and project data synced to that account. Deletion is completed within 30 days. Photos are never stored on our servers, so there are none to delete.
In the mobile app, you can erase all data stored on your device at any time from Settings → Clear all data, or by uninstalling the app. In the web app, delete the site data for app.deciphr.tech in your browser's settings; download a backup first if you may need your work again.
If you have any questions about this privacy policy, or wish to delete your account and associated data, please contact:
Salem M. Alajmi
PhD Researcher · University of Reading
PAAET, Kuwait · University of Reading, UK