YogatikWhat stays on your device
Conversations, uploaded documents, settings, personas, skills and API keys are stored in your browser's IndexedDB, on the device you are using. They are not transmitted to the developer, because there is no application server to transmit them to.
Clearing your browser data for this site erases all of it permanently. Use Export backup in Settings to keep a copy first — the export contains your chats, documents and settings, and deliberately excludes API keys.
What leaves your device
Your messages go to the model provider you chose
This is unavoidable for any AI assistant: the text you send, along with relevant context such as document passages or an image you attached, is transmitted to the provider whose key you configured — Groq, OpenRouter, OpenAI, Anthropic, NVIDIA, Google or another. What that provider does with it is governed by their privacy policy, not this one. Read the policy of whichever you use.
If you run a local model through Ollama or an on-device model in your browser, nothing leaves your machine at all.
Some providers are reached through a proxy
A few providers refuse requests made directly from a browser. For those, requests pass through a small relay operated by the developer on Cloudflare. It forwards the request and returns the response; it does not intentionally store request contents. Standard, short-lived infrastructure logs may exist at the hosting provider. The relay only forwards your API key to a fixed list of known provider hosts — never to an arbitrary destination.
Tools contact the services they name
When the assistant uses a tool, that tool calls the service it is for: a weather lookup reaches a weather API, a web search reaches search engines, an image generation reaches the image service. Those requests come from your browser and carry no identity beyond what any web request does. You can disable any tool individually in Settings.
Optional sign-in
Signing in with Google is optional and exists for one purpose: syncing your API keys between your own devices. It shares your name, email address and profile picture with the app's Firebase project to identify your key vault. Your conversations are never uploaded.
How API keys are protected
- On your device keys live in IndexedDB alongside your other settings.
- In the desktop app they are additionally sealed by the operating system's own credential store (DPAPI on Windows), so they are encrypted at rest.
- When synced they are encrypted in your browser with AES-GCM before leaving, using a key derived from your signed-in account. The stored value is ciphertext.
- In backups they are excluded entirely.
To be precise rather than flattering: this is encryption at rest tied to your account, not a zero-knowledge system. It protects the stored value; it is not a claim that no infrastructure could ever access it.
Cookies, analytics and advertising
The app itself sets no tracking cookies and uses no analytics by default. Product analytics exist in the code but are opt-in and inert unless you enable them.
This site may display advertising supplied by Google AdSense. Google and its partners use cookies and similar technologies to serve ads, including personalised ads based on your prior visits to this and other sites. You can review and change what Google collects for advertising at My Ad Center and read Google's practices at How Google uses information from sites that use its services. Ads are not shown inside your conversations, and advertisers receive no access to them.
Children
The app is not directed at children. You should be at least 13, or the minimum age of digital consent where you live, whichever is higher.
Your control
- Delete everything by clearing your browser data for this site.
- Export a full backup at any time, and re-import it elsewhere.
- Remove a stored API key from Settings; removing it locally also removes the synced copy.
- Disable any individual tool so it is never offered to the model.
- Sign out to stop key sync; conversations were never synced.
Contact
Questions, corrections or privacy requests: applicationmanifester@gmail.com.