Analyze CSV Without Uploading: Keep Your Data Private

Can I analyze a CSV without uploading it to an analysis server?

Yes. AskCSV reads a selected file or pasted delimited text in your browser. A local model uses column information and a few sample rows to generate a read-only SELECT; DuckDB-Wasm executes it over the loaded table, and the model interprets the result. The full raw file is not placed into the model's prompt. See how the calculation pipeline works.

Selecting a file in a web page does not by itself mean sending it to a server. What matters is what the application does with the bytes afterward. Local analysis avoids a remote analysis copy, but it does not remove the need to review the website, device, and browser environment. Cloud-based workflows have their own access and retention controls; choose the boundary your organization actually needs.

What stays local, and what can use the network?

The privacy boundary is analysis content, not all activity associated with using the site.

The privacy policy describes website-level data handling. A local analysis boundary is not a claim that authentication, payments, telemetry, or advertising never contact external services.

How can I check network behavior without using private data?

Use invented records and inspect outgoing requests across all destinations. This is a practical check of an observed session, not a proof about every version, device, or future action.

Create a small local file named local-check.csv, or paste this synthetic content into the file input:

region,revenue
SYNTHETIC_ONLY_NORTH_8472,120
SYNTHETIC_ONLY_SOUTH_8472,80

Neither the labels nor the amounts represent customers or business records. Do not substitute real customer, employee, patient, or financial data for this test.

1. Start recording before loading the app. In a WebGPU-capable browser, open developer tools and the Network panel. Enable recording and Preserve log, select All, clear text filters, and then navigate to AskCSV. Do not restrict the view to Fetch/XHR or to requests containing the filename.
2. Observe setup separately. Load the synthetic rows and, if needed, approve the approximately 1.8 GB first model download. Note the timing and destinations of app and model downloads. They are network activity, but downloading model weights is not uploading your CSV.
3. Run a recognizable question. Ask: "What is total revenue for region SYNTHETIC_ONLY_NORTH_8472? Show a table." The arithmetic expectation is 120; that is not a recorded AI result. Keep recording during analysis and follow-up activity.
4. Inspect destinations and outgoing content. For same-origin requests and external domains, inspect the request URL, query parameters, headers, method, and request body in the Payload view where present. Check the Initiator to understand what triggered a request. Include beacon or Other entries, and outgoing WebSocket messages if any exist. A request can send data through URL parameters without using POST.
5. Search for content, not just the filename. Search the recorded request content for SYNTHETIC_ONLY_NORTH_8472, the question, and any visible SQL. Distinguish outgoing payloads from downloaded responses. Inspect encoded or compressed payloads with appropriate tooling when necessary; if you cannot interpret a payload, record that limitation rather than treating it as empty.
6. Keep the conclusion narrow. Finding analysis content in an outgoing request would contradict the stated boundary. Finding no readable marker is supporting evidence only for what you inspected. A filename filter showing zero requests cannot establish that no upload occurred: filenames can be omitted, requests renamed, and content encoded.

Do not send network logs or HAR files to a third party to perform this check. Even a synthetic-data session can produce logs containing cookies, account details, or request tokens. Keep inspection local and avoid sign-in or payment actions unless they are separately required by your review.

For another safe test with known totals and averages, use the six-row summary exercise. The Chrome DevTools Network reference explains recording, payload inspection, and searching requests.

What should an organization review before using confidential files?

Review the endpoint as well as the transfer boundary. Consider managed browser profiles, extension permissions, device encryption, screen locking, shared accounts, clipboard rules, downloaded exports, backups, and how browser-saved work is deleted. Browser storage is not a managed records archive or a guaranteed backup.

Use your organization's security and legal review process to determine whether the workflow is appropriate. Local processing alone does not establish GDPR or HIPAA compliance, nor does it replace contractual or retention requirements. If the device environment is not approved, keep the evaluation limited to synthetic data.

Frequently asked questions

Can I use it without an account?

Yes. Free includes 10 successful analyses per month with no account required. Pro is $5/month for unlimited successful analyses, conversation ZIP and chart PNG exports, deterministic two-file combine, and no ads.

Does no analysis upload mean fully offline?

No. App and model downloads, authentication, billing, analytics, and ads can need connectivity. Cached model reuse is not guaranteed, and AI analysis requires WebGPU-compatible hardware and browser support.

Which files can I test?

CSV, TSV, and delimited TXT, including pasted delimited rows. .xlsx workbooks are not supported directly; export a sheet as CSV first.

Technical references

• DuckDB-Wasm query execution documents the local database mechanism, not a certification of an application's privacy controls.
• WebLLM getting started describes in-browser model inference and its WebGPU requirement.

Start with synthetic data, then evaluate whether your own environment meets your organization's requirements.