When you send a message in Polymeti, your browser talks directly to the AI provider you picked, using your own API key. Our server is not part of that exchange — it doesn't relay your message, doesn't log it, and cannot read it. This isn't a policy promise: the backend has no endpoint that accepts conversation content, so there is nothing to trust us about.
What goes where
- Your messages and attachments go from your browser straight to the provider's API over HTTPS. Every provider request — chat, image generation, voice transcription, even testing a new key — is made the same way.
- Your API keys are stored in your own browser and sent only to the provider they belong to. They are never persisted on our server.
- Your conversations live in your browser's local storage. If you enable sync, transcripts go to your own Google Drive — not to us.
- What our server does handle: your sign-in (via Google or Microsoft), the model catalog and your app settings, and anonymous-to-us usage numbers — token counts per model, never text.
Check it yourself — two minutes
- Open your browser's developer tools (F12, or right-click → Inspect) and select the Network tab.
- Filter by Fetch/XHR, then send any message in a chat.
- Look at the request that carries your message: its destination is the provider's own domain —
api.openai.com,api.anthropic.com,generativelanguage.googleapis.com,api.x.ai,api.deepseek.com, oropenrouter.ai— not ours. - After the reply finishes you'll see the one request that does go to our server:
POST /api/usage/report. Click it and read the payload — a model name and token counts. That's everything we receive about your conversation.
Enforced by your browser, not by our promises
The app ships with a strict Content-Security-Policy: the connect-src directive enumerates every host this app is allowed to contact, and your browser refuses anything else. You can read it in any response's headers. Even a bug — or a malicious change — couldn't quietly send your data somewhere that isn't on that list.
What this doesn't change
- The AI provider you send to processes your message under its own terms. Choosing the provider — and the key — stays in your hands.
- If you enable Drive sync, your transcripts are stored in your own Google Drive under Google's terms.
Why it matters
Data we never receive cannot leak from us, be sold by us, or be demanded from us. If we were ever compelled to produce your conversations, the honest answer would be the only possible one: we don't have them — and never did. For the details of the little we do store, see the Privacy Policy.