How your messages reach the AI provider
Polymeti is designed to send your messages straight from your browser to the AI provider, using your own API key. Our server is not part of that exchange, so it never sees what you write. This is how it works for most providers, and they are marked Direct. Read more
Providers: OpenAI (GPT), Anthropic (Claude), Google (Gemini, Gemma), DeepSeek and xAI (Grok)
Although we try to keep it this way, it isn't always possible, for technical reasons — for example, a provider's servers may refuse requests that come from a browser (CORS restriction). For that reason, some providers and their models can be reached only through our proxy: your browser sends the request to our server, which passes it on to the provider unchanged and keeps nothing. They are marked Via our proxy. Read more
Providers: Z.ai (GLM)
You can see each provider's badge in Settings, on the API keys page.
Where your data lives
- Your conversations are stored in your own browser (IndexedDB), not on our server. If you enable sync, transcripts go to your own Google Drive — not to us.
- Your API keys are stored in your own browser too. No key is ever stored on our server. If you enable sync they are copied to your own Google Drive, as plain text — switch API keys off under Sync settings to keep them on this device alone.
- Our server handles your login (via Google or Microsoft), the model catalog and your app settings, and usage numbers: after each answer, which model answered and its token counts, tied to your account but to no chat or message, and never text. We use them to see which models people prefer. It stores no conversation. You can see it yourself: after each answer, your browser's developer tools (Network tab) show one request to our server,
POST /api/usage/tokens, with only the model, its token counts, and whether it went through our proxy.
Enforced by your browser, not by our promises
The app ships with a strict Content-Security-Policy: the connect-src directive enumerates every host this app is allowed to contact, and your browser refuses anything else. You can read it in any response's headers. Even a bug — or a malicious change — couldn't quietly send your data somewhere that isn't on that list.
What this doesn't change
- The AI provider you send to processes your message under its own terms. Choosing the provider — and the key — stays in your hands.
- If you enable Drive sync, your transcripts are stored in your own Google Drive under Google's terms.
Why it matters
Data we never receive, or pass on without keeping, cannot leak from us, be sold by us, or be demanded from us. If we were ever compelled to produce your conversations, the honest answer would be the only possible one: we don't have them — and never did. For the details of the little we do store, see the Privacy Policy.