Privacy boundaries
Understand what account Chat stores, what local Code keeps on the machine, and what privacy controls change.
Account Chat and Files
The Privacy Policy provides the full disclosure. Chat prompts, completions, conversation history, projects, memory facts, uploaded Files, and account preferences are account data. A Chat turn is sent to the selected model provider, while saved conversations and files remain accessible through the account. Deleting a conversation and changing a provider privacy filter serve different purposes.
Privacy filters
In Chat, users open Settings → Advanced to keep the Zero Data Retention and no-training filters enabled. The filters restrict the model picker to routes that advertise the requested policy. A locked row means that the route cannot satisfy the current filter or plan. Zero Data Retention concerns retention by an upstream provider; it does not delete saved Chat history. Speech routes have different provider constraints and do not offer the same Zero Data Retention path, while no-training eligibility remains visible in the picker.
Local Code
Code keeps repositories, branches, worktrees, Git state, terminal buffers, local task data, and vendor credentials on the computer. An account can provide access to Chat, Files, and billing without moving Code transcripts or vendor credentials into the account. The selected coding runtime may still send prompts and relevant task context to its model provider under that provider’s terms. Local storage does not mean every model runs on the computer.
Mobile Gateway
Mobile Gateway is an opt-in connection from a phone to a user-managed desktop route. The desktop grants explicit scopes and remains authoritative. The paired phone receives bounded views and controls; it does not synchronize the repository to the AI Integrator cloud. The gateway can be disabled, a device can be revoked, and device scopes can be changed from desktop Settings → Mobile Gateway. See Mobile, Models, Remote access, and Skills.