Security & data handling

Mizura has local storage and local analysis execution, and it also contacts external services for model responses and literature search. Here is what happens in each place.

What stays on your computer

The desktop app starts its analysis engine on your computer. The engine stores its database, uploaded datasets, session outputs, and logs in the app's data folder. The desktop app chooses that folder for your operating-system user account. Settings in the web interface use your browser's local storage. Keep access to your computer and account limited to people you trust.

Imports from GitHub, Google Drive, and Zenodo are downloaded into the local engine before analysis. Connecting an account may save connection credentials locally so the connector can work; disconnect an account in Settings when you no longer want to use it. See Your data for supported imports.

What can leave your computer

Mizura sends the conversation and the analysis context needed for a response to its configured model service. That context can include information from the dataset profile, attachments, and results from earlier turns. Do not assume that a dataset stays private just because its file is stored locally. The model service and its provider handle requests under the terms that apply to your account. Review the privacy policy before using sensitive data; this page does not make a data-retention promise.

Local storage and local code execution do not mean the model provider receives no data. The product privacy text describes the service, but it is not evidence of a technical zero-retention setting. Confirm the configured provider and account terms before using sensitive data.

Literature search and opening sources use external search and fetch services. GitHub and Google Drive imports also contact those providers. Use the connector’s own access controls and choose only the files you intend to bring into a session.

Voice dictation

When you use push-to-talk dictation, the recorded clip is sent by the local engine to its configured speech transcription service. The default endpoint is Mistral Voxtral; the engine does not store the clip. This provider request is separate from the later model request containing the transcribed text. Confirm the configured provider's terms before dictating sensitive information.

How analysis code is isolated

Analysis code runs in a restricted environment on your computer. On Linux, Mizura uses a separate process with restricted file access, network access disabled, and resource limits. On macOS and Windows, it runs in Pyodide under a restricted Node process. That runtime uses in-process guards rather than an operating-system sandbox; protections, packages, and limits differ by platform. See How code runs for the runtime details.

This isolation applies to analysis code. It does not make prompts, attachments, imports, or results private from the external services used to answer a request.

Sharing and deletion

A session export is a separate copy of your work. Review it before sharing, especially if it contains data about people. A replication package can contain analysis inputs, results, and your report; deleting the session does not remove copies you saved elsewhere. The export contents and large-dataset exception are described in Choose and use an export.

You can delete sessions from Settings → Data & System. That removes the sessions stored in Mizura; it does not remove exports or source files saved outside Mizura. For provider-side data handling and your account rights, use the current privacy policy and provider terms.