Why local-first beats cloud for research papers

There's a class of tools right now that takes a PDF of a research paper, uploads it to a server, and lets you ask the paper questions through a chat interface. They work. They're useful. And they're a strange choice for a researcher.

This post is an argument for why the people most likely to read AI-powered PDF tools — researchers, students, engineers — should be the most suspicious of where their papers go.

What "ask the paper" tools actually do

When you drop a PDF into a hosted AI reader:

1. The file uploads to the provider's servers.
2. The provider extracts the text.
3. They typically chunk and embed it into a vector database — server-side.
4. When you ask a question, the question and relevant chunks go to a large language model API (often OpenAI's or Anthropic's).
5. The answer streams back to you.

For each of these steps, the PDF exists somewhere that isn't your machine: on the provider's storage, possibly in their database, possibly in the model provider's request logs, possibly in retraining datasets if the model provider's terms allow it.

The provider may delete it on a schedule. They may not. Their backups may have it for 30 days. Their staff may be able to read it. Their analytics may know what you asked it.

None of this is paranoia — it's just what the system architecture is.

When this matters more than usual

For a researcher, "uploading a PDF" has more failure modes than the average user:

• Unpublished manuscripts. Reviewers and coauthors routinely look at drafts before publication. Uploading a not-yet-accepted manuscript to a hosted AI reader is a confidentiality breach by default.
• Industry papers under NDA. Anyone who reads patents, internal whitepapers, or clinical trial protocols knows the dance of "what is and isn't shareable."
• Pre-public datasets in the appendices. Many papers include supplementary materials with data the authors are still actively analyzing.
• Citation patterns are sensitive. The set of papers you're currently reading reveals what you're working on. For someone building a competing system, that's gold.

The point isn't that hosted AI readers are evil. It's that the privacy cost is much higher than the privacy cost of, say, asking ChatGPT to summarize a Wikipedia page — and the same researcher who'd never share a confidential manuscript over Slack will happily upload it to a tool that promises "your data is safe."

What "local-first" actually means

A local-first PDF reader keeps the file on your machine. Reads it on your machine. Renders it on your machine. The text never leaves.

But "local-first" doesn't mean "no AI." Most local-first tools take one of two paths for AI features:

1. Bundle a local model. Ship the app with a quantized 7B or 13B parameter model that runs on your laptop's Apple Silicon. Pros: truly nothing leaves. Cons: smaller models, slower, larger app download.

2. Hybrid: local extraction, cloud inference, no storage. The app extracts the relevant text passage on-device, sends only that passage (not the PDF) to a model provider, gets the answer back, and stores nothing on the server. The PDF never leaves; only the question and the relevant paragraph do.

The hybrid model is what most serious local-first tools (including Voixes) use today. It's a compromise: the model provider sees fragments of your reading, but only fragments, only in transit, and only the ones you explicitly asked about. Your full PDF, your highlights, your notes, your reading history — all of that stays on your Mac.

What to look for in a privacy-respecting reader

If you're shopping:

• Where is the PDF stored? "On your Mac, in ~/Library/..." is the right answer. "On our servers, encrypted" is the wrong answer.
• What's sent for AI features? "The selected paragraph and your question" is good. "We need the full document for context" is bad.
• Are answers cached on the server? Some tools cache for "performance" — which means the server has a copy of every Q&A pair you've ever generated.
• What happens to your highlights and notes? Local-only is best. Synced via an account is fine if the sync is end-to-end encrypted. Plaintext-on-the-server is the wrong answer.
• What's the company's funding model? Free tools backed by VC eventually need to monetize, and "your data" is the easiest target.

The compromise isn't as bad as you think

People assume local-first means giving up the magic. In practice:

• Full-text search? Local, instant.
• Concept extraction? Runs on-device with the same models that run in the cloud.
• "Ask the paper"? Hybrid is fast enough that you won't notice the difference vs. fully-cloud.
• Highlights, notes, history? Local SQLite. Faster than any cloud sync.

The thing you give up is "I can access my library from any device." For researchers who do their actual work on one machine, that's a non-loss.

---

Voixes is a native Mac app that keeps your PDFs on your Mac. Highlights, notes, concepts, and reading history all stay local. AI features send only the selected text to a model provider — never the document.