The short version
The default app has no user account, marketing list, or product analytics service. Chats, settings, provider keys, files, Canvas artifacts, memory, knowledge-base chunks, and usage events are stored in your browser.
When you send a message, the selected provider key and request pass through the ai.diy server route to the provider you chose. A hosted instance operator can observe traffic in transit. The app does not require server-side LLM credentials and is not designed to persist provider keys.
Data stored in your browser
Depending on the features you use, ai.diy stores the following locally:
- Provider settings and API keys in browser storage. When Web Crypto and IndexedDB are available, the settings payload is encrypted at rest with AES-GCM; the envelope key is stored separately in IndexedDB. Fallback environments may use plaintext storage.
- Chats, attachments, threads, Canvas artifacts, memory, knowledge-base indexes, usage events, and preview sessions in browser storage.
- Optional cloud-backup credentials in the browser so the client can talk to your chosen storage endpoint.
You can delete local data through the browser or the relevant workspace settings. Export and backup tools are client-side features; review the destination before sending anything there.
Provider and tool requests
Your selected LLM provider receives the prompts, files, and tool context needed for the request. Web search, URL fetch, remote MCP, cloud backup, and other connectors may send data to the service you enable. Those services have their own privacy policies and retention rules.
Do not use a shared deployment for secrets or regulated data unless you have reviewed and trust its operator. For maximum control, self-host ai.diy and configure production logging, rate limits, and access controls yourself.
Optional integrations
- The landing page reads public GitHub profile and repository statistics from the GitHub API. It does not request a GitHub token.
- Login with ChatGPT is an experimental beta integration. It uses a session cookie and third-party community SDK; enable it only after reviewing its consent flow.
- Hosting providers may process normal operational data such as IP addresses, request timing, and server logs according to their policies.
Contact
Questions or corrections can be raised through the project repository or the official X account linked in the footer. ai.diy is open source, so you can also inspect the implementation and deploy it on infrastructure you control.