Private and secure by design: how Bimlyte keeps your BIM models on your device
Bimlyte is a private, local-first IFC viewer and BCF manager. When you open an IFC or BCF file, it is processed entirely by your own browser, on your own device — your models are never uploaded to our servers, and we operate no backend that could store, read, or recover them. When you export a project, you can encrypt it with a password that only you hold.
Does Bimlyte upload my IFC files?
No. Bimlyte does not upload your IFC or BCF files to any server in order to open them. Parsing the geometry, reading the model data, and managing BCF issues all run client-side, in your browser, on the machine you are using.
That makes Bimlyte a practical choice when you need a fast IFC review tool but cannot upload project models to a third-party platform — for example confidential models, early design files and internal coordination files. The project file is processed on your device.
Where is my project data stored?
Your work stays on your own device. Bimlyte saves your models and BCF work in your browser's local storage — including the Origin Private File System (OPFS), a modern browser feature that lets the app handle large files directly and efficiently on your device.
Because the data lives in your browser, how much you can store is limited only by your device — Bimlyte imposes no limits — and clearing your browser storage removes it. When you want a copy you can keep, back up, or hand over, export a .bimlyte package or a report.
Is my BIM data used for AI training or data mining?
No. Your project data is never analyzed by AI, mined, profiled, sold, or copied to an external database. Because Bimlyte has no project-data backend, there is simply no server-side copy of your models to train on or monetize.
This isolation is the whole point of a local-first design: your intellectual property and your clients' confidential information stay under your control, on your hardware.
Can I share a model without uploading it to the cloud?
Yes. When you deliberately choose to hand a project to someone, the .bimlyte format bundles your IFC, BCF, saved views, and viewer settings into a single portable file that you send yourself — there is no shared cloud drive in the middle.
You can optionally protect that .bimlyte file with a password before you share it. The recipient opens it right in their browser, with no BIM software to install.
Do I need an account to use Bimlyte?
No. Bimlyte requires no account, no sign-up, and no login. You open a file and you are already working, with the full toolset available from the first second.
Because there is no account, there is no user profile, no password database, and no personal project history stored on our side — one less place your data could be exposed.
Is a password-protected Bimlyte file actually encrypted?
Yes. When you set a password on a .bimlyte export, the file is encrypted on your device with AES-GCM 256-bit, using a key derived from your password with PBKDF2-SHA256 at 600,000 iterations — the iteration count OWASP currently recommends. All of it runs through the encryption built into your browser; Bimlyte does not write cryptography of its own, because rolling your own is how encryption goes wrong.
One honest distinction, because it matters: only exports you give a password to are protected by that password. An export saved without one uses a key that ships inside the application, which keeps a file from being read by simply unzipping it, but is not a confidentiality measure. If the contents are sensitive, set a password.
What happens if I lose the password to an export?
The file cannot be opened — by you, by us, or by anyone else. There is no recovery link, no reset, and no master key: a password-protected export contains nothing that would let the application decrypt it without the password you chose.
That is a deliberate design decision rather than a missing feature. A backdoor that lets us recover your file is, by definition, a backdoor that lets someone else recover it too. Keep the password somewhere you trust, and keep it separate from the file.
How is the application itself protected?
Bimlyte loads nothing from third-party servers — no external fonts, no CDN scripts, no advertising or tracking code. Everything the app needs comes from its own origin, which means there is no third party in a position to observe your session and no supply of external code that could change under you.
A BCF file you import is treated as untrusted, because it was written by software you do not control and may have passed through several hands. Links inside an imported file can only open as ordinary web or email links, embedded documents are handled so they cannot execute as code, and the archive's contents are integrity-checked before Bimlyte accepts them.
Where can I read Bimlyte's full privacy terms?
This page explains, in plain language, how the Bimlyte app is built to keep your models on your device. For the app's complete, formal privacy terms, open the Bimlyte app's Privacy Policy using the button below.
Whichever way you read it, the principle is the same: Bimlyte runs on your device, and your project files stay under your control.