The short version: your keys are encrypted and never shown back to you; your prompts pass through our servers when a seat runs on Our Keys, or whenever the app doing the work is the web or the phone; on the Mac, a seat running on your own key, a custom endpoint or a CLI talks to the provider directly.
Keys
API keys and OAuth tokens you connect are encrypted at rest with AES-256-GCM. On the web and the phone they are stored on our servers and used only there to run your discussions; no route returns them. On the Mac they are encrypted on that machine and never sync. Team keys are encrypted the same way.
Prompts and files
On Our Keys, the content of a discussion — your prompts, attached files, the seats' answers — passes through our servers so we can send it to the provider and meter it. On the web and the phone this is true whichever key powers the seat, because the app runs on our servers. On the Mac, with your own key, a custom endpoint or a CLI seat, the Mac calls the provider itself and the content does not pass through us.
Discussions
A discussion synced to your account is stored on our servers so the other apps can show it. A Mac discussion that is never synced stays on the Mac. Shared links and team sharing are yours to turn on.
Where
Our servers and database run on Fly.io in the United States, so your data is processed there wherever you live. The apps carry no advertising trackers; page-view analytics on the site names nobody.
Deleting
Settings → Account → Delete account removes the account and everything stored with it. You can also email support from the address on the account and we will delete it. The full policy is at letthembuild.com/privacy.