Skip to content
MachAI Lens Help

Data and privacy

Lens is local-first: it parses your reports on your machine.

The full privacy policy, terms of service and security documents are in the Lens repository you were given access to, under chipcopilot_flow/Docs/: PRIVACY_POLICY.md, TERMS_OF_SERVICE.md, SECURITY_AND_DATA.md and ENTERPRISE_SECURITY_WHITEPAPER.md. This page summarises what they say and what the code does; where they differ, the documents govern.

What leaves your machine

Your timing reports and design data are processed on your machine and are never sent to MachAI servers during normal operation.

Nothing is sent to MachAI at any time: Lens has no MachAI server to talk to, no telemetry and no update check. The only network traffic Lens can make is the optional one below, and it goes to Anthropic, not to MachAI.

The only outbound traffic is optional. If you turn on LLM-powered explanations and configure an Anthropic API key, the generative explanation actions in Digital Soul send Anthropic a structured evidence pack.

  • Prompts contain curated evidence summaries only. Raw report, log and SDC text is never sent.

  • Deterministic actions never call out at all.

  • The constraint-evidence actions (Review Constraint Evidence, Review Path Constraint Evidence) never call Claude, and raw SDC text never enters any prompt.

An evidence pack is a structured summary that Lens builds from its own parsed results: per-clock and per-scenario figures such as WNS, TNS, violation and path counts, slack distributions and aggregated net statistics, together with the names of the clocks, scenarios, path start and end points, and the nets and cells that the evidence singles out, so that Claude can refer to them in the explanation. It never contains report lines, log text, constraint text or file paths. Whether the design names in a pack are acceptable to send off your machine is your call: if your reports fall under a foundry or customer NDA, review that with your legal team before turning explanations on, or leave them off; Lens is fully usable without them.

MachAI's zero-retention statement is about MachAI: it never receives your data, so it has nothing to retain. What Anthropic does with the requests Lens sends is governed by your own agreement with Anthropic, under whose API key the requests are made; see Anthropic's privacy policy. Lens makes no claim about Anthropic's retention.

Anthropic is the only provider. There is no OpenAI route.

The agent crews that older documentation describes have been removed from Lens, and with them the only code that ever used another provider. The Logs tab reads log summaries from your local folders and sends nothing anywhere.

This documentation site and its assistant are separate from Lens, and they do keep records. When you sign in to this site, and when you ask the assistant a question, MachAI records it against the email you signed in with: sign-ins are kept for 180 days and questions for 30 days. MachAI uses these records only to manage who can use the site and to improve the documentation, and never sends them anywhere else.

Turning explanations on and off

Lens starts and works without a key. Deterministic analysis is always available; only generative explanation actions need a key.

To turn explanations on, go to Settings → LLM Configuration:

  1. Turn on Enable LLM-powered explanations.
  2. Paste your Anthropic API key into API Key.
  3. Select Test Connection, which verifies the key and the model round-trip.

With Enable LLM-powered explanations off, Lens is still fully usable. Without a key, explanation cards are badged Deterministic fallback and an amber banner explains how to turn explanations back on.

Your API key

The API Key field is masked. The key you enter in Settings is stored in the local settings file.

If the field is blank, Lens uses the ANTHROPIC_API_KEY environment variable of the terminal you started it from, when there is one; a key typed into Settings takes precedence over it, and the hint under the field says which is in use.

The key you type is written, as plain text, to ~/.chipcopilot/machine_settings.json, the machine-local settings file that holds every setting you change. Lens never copies that file anywhere; protect it as you would any file holding a secret. If you would rather not keep the key on disk, leave the field blank and set the environment variable in the terminal you start Lens from instead.

What Lens stores, and where

Lens keeps its settings, projects and run data in a .chipcopilot folder in your home directory:

~/.chipcopilot/
├── machine_settings.json                   # machine-local settings and your overrides
└── users/{username}/
    ├── user_config.json                    # last viewed project, default UI preferences
    └── projects/
        ├── project_registry.json           # project list, current project
        └── {project_name}/
            ├── settings.json               # directories, current build, extraction pattern
            ├── timing_review_data/
            │   ├── ui_prefs.json           # project-level UI state (Timing Review and Lens Compare)
            │   ├── build_registry.json     # registered builds, active build per tool
            │   └── builds/{build_name}/
            │       ├── run_metadata.json   # index of runs for this build
            │       └── timing_review_{run_id}.json   # one file per run
  • Run data is kept per project and per build, under builds/{build_name}/.
  • UI preferences are kept per project, in one ui_prefs.json shared by all builds in the project. This scoping is incomplete (a known issue), so preferences can leak between projects when you switch projects in the same session.
  • Each run stores aggregates (design information, a summary, the per-clock breakdown and alerts), not per-path records. Lens rebuilds path evidence on demand from the configured reports, with a disk cache, so after a restart it needs those reports to still be in place.
  • With no project open, Lens uses a separate fallback store. Preferences you set with a project open are not the ones it reads there.
  • Caches for net-segment analysis are kept under cache/longnet/.
  • Lens writes nothing to your report tree. It is read-only with respect to your design data.

The net-segment cache is ~/.chipcopilot/cache/longnet/, inside the same data folder; it holds parsed net-segment data from your reports, so it does contain design data, and it is the disk cache Lens uses when it rebuilds path evidence. The fallback preference store used with no project open is a ui_prefs.json kept inside the Lens code folder itself (chipcopilot_flow/src/chipcopilot_flow/timing_review/data/), and holds UI state only. Set CHIPCOPILOT_DATA_DIR before starting Lens to move the whole ~/.chipcopilot data folder elsewhere.

Digital Soul's shared history is kept on disk between sessions, in ~/.machai/lens_ai/ds_history.json (a separate folder from ~/.chipcopilot), with up to 250 entries, each holding a snapshot of the card so you can reopen it later; clearing the history in the panel also clears the file. Lens also keeps an audit log of Digital Soul actions in ~/.chipcopilot/lens_ai_audit.jsonl. The Evidence Ledger is Digital Soul's in-memory record of the evidence it gathered during an investigation; it lives only for the session and is never written to disk.

Still have a question?

Updated 2 November 2026