Where your data goes.

Your prompts

Processed in this browser tab. Sample responses are prewritten; nothing is sent to an AI provider.

Your conversations

Kept in your tab’s memory by default; refreshing clears them. You can choose to save them in your browser on your device, and download or delete them at any time. Memory notes and saved prompts are kept the same way. Your memory notes go with each message, as part of its instructions, unless you turn memory off; a model can offer a note, but none is saved unless you choose Save. A ChatGPT, Claude, Gemini or Perplexity export you import is read in your browser and isn’t uploaded; the conversations you pick from it are kept like any other. Notion, Obsidian and Markdown notes, bank statements and health records you bring in are read the same way, in a worker with no network access, and kept like documents; a model sees them only when you choose to ask it, and only the parts you pick (for statements, payee names only). Pages you watch are fetched through Undergrove’s server while the workspace is open, as when you add a web page. If you turn on sync, your browser encrypts each conversation (with its own settings and instructions), document, project, memory note, saved prompt, watched page, spending record and health record, and your memory setting, with a key only your devices hold, shown to you once as a recovery code. We store that ciphertext, with each item’s size and update time, and can’t read it. If you add a passkey to unlock sync, your browser locks the key with a secret that only that passkey produces, through the WebAuthn PRF extension; we store the locked key with the passkey’s ID and the name you give it, and can’t open it. A shared link holds an encrypted copy of a conversation or project for 1, 7 or 30 days, as you choose, or until it’s first opened if you share it to open once. Its key is the part of the link after the #, which browsers don’t send to us. A password you add to a link is used only in browsers, where it’s combined with that key, so we never see it either.

Shared projects

When you share a project with people, its instructions, conversations, documents and the names members give themselves are encrypted in members’ browsers with a key we never have. Each person gets that key sealed so only their own devices can open it, and only after the owner’s browser confirms them; an invite link alone doesn’t carry it, and works once. We store the ciphertext and see who is in each shared project, each member’s role, public key and join date, when invites are made and used, and each item’s size and update time. Our server checks roles before it accepts a change. Removing someone stops us sending them anything and gives the project a new key for the others, but it can’t take back what they already downloaded or copied.

The public gallery

Publishing to the gallery is a separate choice from sharing a link, and isn’t encrypted. What you publish, an assistant’s set-up, a workflow’s steps or an app’s code, with the name you give it, is kept as sent and shown to anyone until you unpublish it or an admin removes it; its conversations and documents aren’t part of it. Reports are kept under a one-way hash of the reporter’s account or network address.

Your files

Only file names, sizes, and types are used. Contents are never read or uploaded.

Web search and web pages

Without live access, nothing is searched or fetched from the web.

Tools and model choice

Auto picks a model in your browser, and blind test votes are kept there too, saved only if you turn on saving.

Model routes

No model route is open yet. Every route will be listed here with its operator, location, and retention before it carries a single message.

Usage limits

To enforce fair-use limits, the gateway counts requests and estimated spend per account or key under a one-way hash. Counters expire within two days and contain no message content. A key’s own daily cap and model list are stored with the key. The workspace’s 30-day usage history is estimated in your browser from each answer and isn’t sent to us; it’s kept on your device only while you save conversations there.

Tracking

No advertising or analytics SDKs are included. Where our server keeps product counts, the workspace sends at most one report a day: one yes-or-no question about that visit, such as whether web search was used, answered with randomised response (local differential privacy, ε = ln 3), so the answer sent is the true one three times in four. The report holds only the question and the answer, with no account, cookie or identifier; the server adds it to that day’s totals and keeps nothing else. Nothing is sent if you turn product counts off in the workspace’s Settings › Privacy, or if your browser sends Global Privacy Control or Do Not Track. The method and the counts are on the product counts page. Account sign-in, when configured, uses Privy. Chat content is never sent to Privy. Payments are not enabled.

Crash reports and speed figures

Crash reports and speed figures are off until you say yes, and you’re asked once, shown exactly what would be sent. A crash report holds an error’s type, its message with anything that could be your content taken out, and where in our code it happened; speed figures are numbers of milliseconds. Both go to our own server with no account, cookie or address. Crash reports are counted by error, with the first report of each error kept, for 90 days; speed figures are added to public totals by day and not kept themselves. Change either in the workspace’s Settings › Privacy.

Landscape motion

On supported phones, device orientation moves the landscape. Browsers that require permission ask when you tap Enable tilt. These readings stay in page memory and are never stored or transmitted. Your reduced-motion preference disables the effect.

The site host

Vercel hosts the site and the gateway, and receives ordinary requests, which include your IP address. Its infrastructure logs and retention are controlled by Vercel; we do not promise zero hosting logs.

Model register

Accounts, cookies, and requests

What’s verified, and what isn’t yet

One message, stop by stop

What a provider can see