How Privacy Works

Your conversation history lives on your device by default.

• •Local database stored in your device's protected app storage
• •Selected content leaves your device only for features that need a network service, such as AI requests, sync, remote backups, connectors, diagnostics, or support
• •Stored conversations and settings remain available offline; remote AI and connected features require their services
• •Local deletion controls are available in the app; operating system backup and uninstall behavior varies by platform

Your API keys are stored using your device's built-in security features.

• •The app sends readable keys to the provider endpoint that uses them and does not automatically add them to support or diagnostic payloads
• •If you enable sync, keys are encrypted with your personal encryption key before upload

We use industry-standard, battle-tested encryption.

• •Authenticated encryption — Data integrity verified, not just confidentiality
• •Strong key derivation — Your passphrase is processed with computationally intensive algorithms to resist brute-force attacks
• •Unique keys per user — Your encryption key is mathematically derived from your passphrase
• •Random initialization — Each encryption operation uses fresh random values

If you choose to sync, your data is encrypted before it ever leaves your device.

• •End-to-end encryption: data is encrypted on YOUR device before upload
• •Synced content fields are uploaded as ciphertext; Supabase separately sees account and operational metadata
• •Email, Google, and Apple accounts use a separate sync passphrase; recovery-phrase accounts derive sync-key inputs from the phrase
• •Database-level isolation ensures users can only access their own encrypted data
• •Account deletion uses a durable server-side cleanup flow and is reported complete only after the service confirms removal

You don't need to give us your email to use cloud sync.

• •Create an account using a 12-word recovery phrase (same standard used by cryptocurrency wallets)
• •Your phrase is processed entirely on your device to create account credentials and sync-key inputs
• •No email, phone number, or personal information required
• •Same phrase = same account on any device (for recovery)
• •Account setup and recovery do not transmit the phrase; only derived credentials are used with Supabase

The route depends on the AI connection you choose.

• •Bring-your-own-key requests go from the app to providers such as OpenRouter, OpenAI, Google, or your configured endpoint
• •On supported non-Apple builds, limited free-tier requests pass through an UnboundChat Supabase Edge Function before OpenRouter
• •The selected prompt, attachments, and context are processed by the route used for that request; local history is not uploaded merely because it exists on your device
• •Zero Data Retention mode: Filter to endpoints represented by OpenRouter as supporting its Zero Data Retention policy

Our logging is designed to help troubleshoot without compromising your privacy.

Automated telemetry excludes conversation text. Content or a diagnostic tail that you explicitly attach to a support report is sent as part of that report.

• •One telemetry setting controls future Supabase analytics and Sentry crash-report sends
• •Remote analytics can be completely turned off in settings
• •A random installation identifier is used instead of an account ID; it can correlate diagnostics and free-tier quota activity for that installation

Use in-app controls to delete local data or request cloud-account deletion.

• •Delete individual conversations or clear everything locally
• •Request cloud-data and account deletion from settings
• •The app waits for durable server confirmation before reporting account deletion complete
• •Backups in destinations you control must be deleted separately; infrastructure copies age out under provider retention rules

Security Summary