What data is collected
Secure Custom AI Chat collects no personal data on the server. The application is designed to operate with zero server-side data retention:
- No account required — No registration, email, or password is needed
- No chat history on servers — All conversations are stored locally in your browser (IndexedDB)
- No analytics — No third-party tracking scripts or analytics are included
- No cookies — The application does not set cookies
The only data transmitted externally is to the AI provider you configure (e.g., OpenAI, Anthropic). This is governed by that provider's own privacy policy.
Local data storage
Conversation history, provider configuration, and user preferences are stored in your browser using:
- IndexedDB — For conversation history and message storage
- localStorage — For UI preferences (theme, sidebar state) and user-configured provider settings (when
ALLOW_USER_PROVIDERS=1)
This data remains on your device and is never transmitted to any server except the AI provider endpoint you explicitly configure.
API key handling
Server-side keys: In default mode, API keys are stored as environment variables on the server. They are never exposed to the browser, logged, or transmitted to any service other than the configured AI provider.
User-configured keys: When ALLOW_USER_PROVIDERS=1, each user enters their own API key in the browser. These keys are stored in localStorage on the user's device and only sent to the provider endpoint the user configures. The proxy server never sees or stores these keys.
Third-party services
The application interacts with the following external services only when you configure them:
- AI Providers — Messages and responses are sent to the API endpoint you configure (OpenAI, Anthropic, OpenRouter, Groq, Ollama, etc.). This is governed by each provider's terms and privacy policy.
- Service Worker — The PWA service worker caches the app shell for offline use. It does not transmit any data.
No analytics, advertising, or tracking services are used.
Security measures
The application implements several security measures to protect your data:
- SSRF protection prevents requests to internal network addresses
- Security headers (Helmet) protect against common web vulnerabilities
- Rate limiting prevents abuse
- API keys are never logged or exposed in client-side code
Changes to this policy
We may update this privacy policy periodically. Any changes will be reflected in the "Last updated" date above. We encourage you to review this policy regularly.
Contact
For questions about this privacy policy, please open an issue on the GitHub repository.