Open client honesty
Privacy claims without crypto theater. Here is exactly what stays on your device, what the proxy must see to answer, and when a request leaves Secrypt.
Three modes (this device)
| Mode | What it means |
|---|---|
| Ghost | Chat is not written to local history. Closing the tab forgets it. The model still processes your turns in memory to reply. |
| Local history | Conversations saved in this browser only. Servers do not write message content to disk for chat product history. |
| Encrypted at rest | Local history wrapped with AES-GCM and a client-held device key. Not the same as end-to-end encryption of inference. |
What the proxy sees
To generate a reply, prompts travel to the Secrypt inference path for that request. We do not train on your chats and do not sell them. Tool calls (search, fetch, image) are logged for reliability without dumping full chat content by default.
When a request leaves Secrypt
Web search and page fetch contact external engines or sites. Secrypt shows an in-chat boundary label when that happens. Optional search proxy (SOCKS/HTTP) routes those lookups through your tunnel.
Trust receipts
In Settings → Data you can download a session trust receipt: settings flags, Ghost/encrypt state, and whether tools left the private boundary this session — not your message text.