On-device AI vs cloud AI for CSV analysis: an honest comparison

The debate around on-device AI vs cloud AI privacy is usually framed as a slogan: local is private, cloud is not. Reality is more specific than that. What actually matters is which parties receive your data, what they do with it, how long they keep it, and whether you can verify the answer you were given. Those questions have different answers for a browser-based model, a general chatbot, and a hybrid that splits the work.

What the two approaches actually mean

On-device AI runs the model and the database on your own machine, usually inside a browser tab. Your rows never leave the device. In practice this required a compatible browser with WebGPU support, roughly a 1.8 GB model download on first use, and enough memory and GPU headroom to run inference — a bar that a phone, a Chromebook, or a locked-down work laptop often cannot clear.

Cloud AI sends your data to a provider's servers. The provider processes it, stores what it stores, and its retention policy applies. This is how most analysis tools and chat assistants work.

AskCSV splits the two. The file stays in your browser, where DuckDB compiled to WebAssembly runs the read-only SQL, does the arithmetic and feeds the charts. The model that turns a question into SQL and explains the result runs at OpenAI, called through AskCSV's server.

Why the model moved off the device

The honest reason is reliability. A browser model is a hard requirement disguised as a feature: it fails or crawls on exactly the devices most people use. When the model depends on the visitor's GPU, the same question produces a fast answer on one machine and an error message on another, and mobile support is theoretical.

Running the model on a server changed that:

• Every device works. There is no WebGPU requirement and no 1.8 GB download. The browser still needs enough memory for the file you open, but not to run a model.
• The first answer is immediate. There is no setup step before you can ask a question.
• Multi-file analysis works. Two CSVs can be joined or stacked in one chat, because the browser queries them locally.

The cost of that change is real and worth stating plainly: some data now leaves your browser. AskCSV keeps it to a minimum — your question, the file's name and row count, the columns you choose to share with up to 10 sample rows, up to 100 rows of each query result plus summary figures, and the earlier messages in the chat. The file itself does not leave. That is a smaller exposure than sending the whole export, but it is not zero, which is why the rest of this page is about what happens to the data.

What AskCSV does with your data now

• Open in the browser. The file is read into this site's storage on your device and queried there. It is not uploaded to AskCSV.
• Read-only SQL. Questions are answered by running read-only DuckDB queries against the local file. A query cannot write to, modify, or delete your data, read other files, or reach the network.
• What the AI sees is kept to a minimum. The AI provider, OpenAI, gets only your question, the file's name and row count, the columns you chose to share, up to 10 sample rows from those columns, the earlier messages in the chat, and the result the browser computed — up to its first 100 rows, from shared columns only, with figures computed from the whole result. The file itself is not sent, but a result can hold real rows: ask for the five largest orders and those five rows go.
• Deterministic numbers. Totals, counts, shares, and trends come from the query result and are computed in code. The AI explains the result; it does not invent the figures.
• Visible SQL. Every chart shows the SQL that produced it, so you can check the calculation instead of trusting the prose.
• Clear retention. Files and chats stay in your browser until you delete them or clear the site's data. Guest credits expire 7 days after they are issued. AskCSV's server keeps a hash of the request context, token counts and the charge — not the question, sample, result or answer text.
• Disclosed sub-processors. OpenAI for AI, Google for sign-in, Stripe for payments, PostHog for cookieless aggregate analytics, and Vercel for hosting. There is no advertising. The database runs on Oracle Cloud Infrastructure. The privacy policy is the authoritative list.

Where on-device analysis still wins

If a file legally or contractually may not be shared with a third-party model at all, then no tool that calls one is acceptable, including AskCSV. AskCSV keeps the file on your machine and minimizes what it sends, but it still sends the question, the columns you choose to share with a sample, and up to 100 rows of each query result. If even that is too much, use an analysis tool that runs entirely offline.

Two further points that a hosted model cannot claim:

• No third-party sub-processor means no sub-processor to review; a tool that calls a hosted model always has at least one.
• No retention question at the provider means nothing to delete later; AskCSV's AI provider still receives each question, sample and query result under its own retention terms.

Those are the real trade-offs. If your privacy review cannot accept them, keep the analysis offline.

Where this hybrid wins

• It runs everywhere, which is the difference between an analysis tool you use on your phone and one you never manage to use at all.
• The calculation is verifiable. With a visible SQL query and numbers computed in code, you can check a total rather than hoping a model summed rows correctly.
• The file does not leave the device. Browser storage plus a capped AI context, kept to a minimum, is a smaller exposure than uploading the whole export.
• Retention is explicit. Files and chats stay until you delete them or clear the site's data, and guest credits expire after 7 days.

Frequently asked questions

Is my file still private?

It is private in a specific sense: it stays in your browser, is queried read-only, and is never uploaded. What leaves the browser is kept to a minimum — the question, the file's name and row count, the columns you choose to share with up to 10 sample rows, up to 100 rows of each query result plus summary figures, and the earlier messages in the chat — and only when you ask a question.

Can I avoid sending the full file to an AI model?

Yes, and AskCSV does that by design: the file never goes to the AI provider, which gets only the context listed above, kept to a minimum. In a small file, though, a question that lists every row sends every row of the shared columns, so turn off any column it should not see.

Does AskCSV connect to my database?

No. It analyzes files you open, with no direct database connection.

Can I still use AskCSV without an account?

Yes. Guests get $0.25 of credits to try it (about 5 answers). Sign in with Google to subscribe; your file stays in this browser either way. A $5/month subscription includes $5 of usage each month (about 100 answers); add credits from $10 (about 200 answers) when you need more. A typical answer costs about $0.05. Credits are charged only for the tokens the AI actually processes.

Try it and check the SQL yourself

Open a file you are authorized to analyze at / and look at the query behind the first chart. If the honest summary above does not fit your requirements, choose a tool that never calls a hosted model — that is a legitimate answer, and better than a workflow you cannot defend in a review.