Privacy

OT Studio has no server of its own. It shows no ads and collects no analytics. Every request goes straight from your device to the provider you configured, and that provider's terms, billing, logging, and retention rules apply. This page is a summary; the full notes are in the Android privacy document and the desktop privacy page.

What leaves your device

A chat message goes to the chat provider with a limited amount of recent history. With chat on the phone, or with Ollama on the desktop, nothing leaves the device.
A picture or video prompt goes to the media provider with the inputs you chose. A photo you add is redrawn as a new JPEG before it leaves, which drops its location and camera details.
Web search on the phone sends only the search words to Wikipedia, or to Tavily when you saved a Tavily key, never the conversation.
LoRA training sends JPEG copies of the photos you chose to Replicate, in one ZIP, and creates a private model in your own Replicate account. Your originals stay where they are.
Nothing goes to OrangeTiger, to an analytics service, or to a storage host with a key attached.

Where your keys live

Android

Each key is encrypted with AES-GCM under a key held in the Android Keystore. Keys never appear in the source code, the APK, the logs, or Android backups. Release builds block screenshots of Settings.

Windows

Windows encrypts the keys for your Windows account. Updates keep them. The key file name and format are pinned by a test that is never edited to make a change pass.

Linux

Keys are stored in your desktop keyring, GNOME Keyring or KWallet, through libsecret, the same place your browser keeps its passwords.

On every platform a key goes only to the provider it belongs to, only in the request header that provider expects, never in a body or an address, and never to a host that stores results. A redirect to another origin drops the key.

Paid requests

A paid request is sent once and never repeated on its own. If the connection breaks after sending, the job says Outcome unknown, because the provider may have done the work and billed for it. Free status checks may repeat. In the chat, the model only writes a plan; the app validates it and starts a paid job only when you tap Generate or click Go.

What stays on your device

Prompts, answers, job details, chosen inputs, model profiles, LoRA references, and media details live in the app's private storage: the app's private databases on Android, %APPDATA%\OT Studio on Windows, and ~/.config/OT Studio on Linux. Generated files download there the moment they finish. Save copies a file into a folder you chose, and that copy belongs to you.

Removing the app, or clearing its storage, deletes the history, the settings, the keys, and every unsaved file. The app keeps no cloud backup. Android cloud backup and device transfer are switched off for this app.

What the desktop app may reach

Only the main process reaches the network, over https, to these hosts: api.replicate.com and replicate.delivery for Replicate, api.spicyapi.com and cdn.spicyapi.com for SpicyAPI, openrouter.ai for OpenRouter, and the addresses you allowed in a dialog. Ollama is reached at 127.0.0.1 on your own PC, the only address without https. A pasted example is read as text and never run. A shared service file is data and holds no key.