Privacy and security
WorkflowRemix is local first. Your media is served straight off your disk and never leaves the computer, and nothing phones home in the background.
What leaves the computer
| Service | Where | What it is for | What is sent |
|---|---|---|---|
| ComfyUI | On your computer | Runs the workflows. The app queues runs, follows progress and uploads input images. | Nothing leaves the machine. |
| GitHub Releases | Cloud | The update check, 10 seconds after launch and every 4 hours, and the download of a new version. | A request to github.com: your IP address, and the fact that a copy is checking. Nothing about your media, prompts or settings. |
| Civitai | Cloud | Model downloads that need an account, if you store an API key for them in Settings. | Only the requests you start yourself. |
| Tailscale | Your own network | Remote access, if you switch it on. | Traffic between your own devices, encrypted end to end. |
The update check is the one request the app makes without being asked. There is no account, no licence server, no analytics and no crash reporting.
It runs only in its own window
The app is a small server and a window that shows it. The server listens on this computer only and answers nothing but that window: any other program, or a browser pointed at its address, gets a page saying where the app is.
The window itself is held to its own server. Every image, script, font and connection has to come from the app; a link to anywhere else opens in your system browser and not inside the window.
Where your data lives
In the one folder you chose on the first launch: settings, prompts, rules, the job list with every prompt it ran, logs and, unless you put it elsewhere, the media library. File → Show Data Folder opens it.
- A folder the app creates is made private to your account.
- To back it up, copy the folder while the app is closed. The settings file in it holds your API keys and your password's hash, so treat a backup as you would the original.
- Uninstalling leaves the folder in place. Deleting it is how you remove everything.
System search
A library that Windows Search or Spotlight indexes is one whose file names can turn up in the Start menu or in Spotlight for anyone at the desk. Under Settings → Config → Paths the app says, for each folder it keeps things in, whether the system indexes it, and names the system setting that excludes it. It only reads; it changes nothing about what is indexed.
A password for the app
Settings → Security. With a password set and Require a password ticked, the whole app sits behind a lock screen: pages, files, thumbnails and the live connection to ComfyUI alike.
- At least 7 characters; 12 if you use remote access.
- Only a salted hash is stored, never the password.
- Changing it, removing it or switching protection off needs the current password. Being signed in is not enough.
- Sign out every device ends every session at once without a new password. It is the button for a lost phone, and can be pressed only at the computer.
Forgotten it? Close the app, open config.json in your data folder, remove the auth entry and start the app again.
Safe mode
The eye in the browse bar hides any file whose prompt matches a word on your filter list, from listings and from the word directory. It is for a shared screen, or someone looking over your shoulder.
- The list is yours, under Settings → Privacy, and starts with only a few generic words.
- Matching ignores case and sees through digit-for-letter spellings, which model and LoRA file names use on purpose.
- A video and the still beside it are one item: if either is flagged, both are hidden.
- On a device using remote access, safe mode is held on by the computer and the list itself is never shown there, unless you tick Show flagged media on remote devices at the computer.
It is a filter on prompt words, not an image classifier. It hides what the words in a file's prompt match, and knows nothing about a file with no prompt in it.
Media caching
Settings → Privacy → Media caching decides whether thumbnails and media the window has already loaded may be kept on disk for reuse. The default is never. Signing out clears what was kept.
The built-in safeguard
Every run is read before it reaches ComfyUI, whichever screen or device it came from.
- A run that describes a minor sexually is refused. A few words are refused wherever they appear. An age under 18, or a word such as “teen” or “high school”, is refused when a sexual word is present as well. The names of the models and LoRAs are read as well as the prompt, and a word on your own safe-mode list counts as a sexual word too.
- An ordinary picture of a child, or of a school, runs. So does an ordinary adult prompt.
- Every run that goes on gets a few words added to its negative prompt: age words, or, where the prompt names a minor, sexual words. A file therefore records a negative prompt slightly longer than the one you typed.
- Nothing switches it off. There is no setting for it.
A refused run tells you which words it was refused for. If the prompt was about an adult, say so plainly (“a woman in her thirties”) and drop the word that reads otherwise.
It is a word check and not an image classifier: it stops the run that asks, and cannot see what a model draws unasked. What you make remains your responsibility under the Acceptable Use Policy.
This website
It sets no cookies, runs no scripts and loads nothing from any other site. The Downloads page links to the installers on GitHub; your browser talks to GitHub only when you click one.