In your browser. Every message, every attachment and every tag is stored on this device.

When you send something, it goes from here straight to the model provider, signed with your own API key. It never reaches us. The one exception is Z.ai, which refuses requests from a browser: those pass through our proxy, which stores neither your key nor your messages.

You don’t have to take that on trust. Open your browser’s network tab, send a message, and read the request list.