What happens to your data, in plain language. This page describes the app's actual current behaviour rather than a static legal document, and is updated alongside the app itself.
InBrowser runs entirely in your browser tab. Nothing here requires an account or sign-up, and no server of ours receives, stores, or logs your conversations, files, or usage. To be exact rather than absolute: a server of ours does serve you this page, so it sees the request for the page itself, the way any web server does. What it does not see is anything you do afterwards - your chats, your files and your settings never leave your browser. There are two narrow exceptions, both described below: the starter prompts on the empty chat screen, and the optional proxy relay, which is used only if you choose to configure a proxy yourself.
The suggestions on the empty chat screen refresh once a day, so your browser asks a server of ours for them. That request carries two things: whether it is currently morning, afternoon, evening or night where you are, and up to three yes/no flags for what your selected model can do - whether it can look at images, run tools, and reason at length. They are there so you are not offered a prompt about a photo on a model that cannot see one. It carries nothing else. No account, no identifier, no cookie, nothing about your conversations or your files, and not even the date. The list you receive is the same list everyone with the same model abilities receives at that hour; it is not built from anything you have done. InBrowser writes the result into your browser's storage so the screen still works offline, and that copy never goes anywhere. The prompts themselves are written once a day by InBrowser's server, not per visitor, and your request never causes one to be written - it only reads the copy already in memory. If you would rather your browser made no such request at all, whoever deployed this copy of InBrowser can switch the feature off, and a version with it off simply shows the screen without suggestions.
Conversations, skills, memories, scheduled tasks, and settings are all saved in your browser's own storage (IndexedDB, localStorage, OPFS, and Cache Storage). None of it is transmitted anywhere by InBrowser. You are always in control: delete a single conversation, clear all chats, or remove individual memories at any time.
When you chat, search, or generate media, the request goes straight from your browser to whichever provider you selected - a keyless provider from the built-in list, your own API-keyed connection, or a self-hosted OmniRoute gateway you configured. Unless you have configured a proxy, InBrowser does not relay that traffic through a server of its own, so each provider sees only your own request rather than a shared pool of everyone's traffic. Each provider is responsible for its own privacy practices once your request reaches it.
If you configure a proxy in Settings, requests take a different path, because a browser cannot speak the protocols real proxies use. They are sent to the same server that served you this page, which opens a tunnel through a Cloudflare worker out to the proxy you chose. Two components, and they see very different things. The worker sees nothing readable. Your proxy's address and credentials are encrypted before they leave the relay, and everything after that is the encrypted connection to the provider, which the worker has no key for. It exists so that the proxy operator sees a Cloudflare address rather than any machine of ours. The relay itself does see your requests. It establishes the secure connection to the provider on your behalf, so the request, the response, and any API key it carries pass through it in readable form. There is no way around that: whichever machine assembles the request necessarily sees what is in it. What we can tell you is what it does with them, which is nothing - it keeps no logs, writes nothing to disk, and holds a request only for as long as it takes to forward it. The relay address is also a setting, so you can point it at one you run yourself rather than ours. None of this applies until you add a proxy. With no proxy configured the relay is never contacted, and your requests go straight from your browser to the provider you picked.
Search and "read this page" features fetch results and page text via r.jina.ai and DuckDuckGo's results page, called directly from your browser rather than through a server of ours - or through your proxy, if you configured one, in which case the relay above applies to them too.
Any provider API key you enter is stored locally in your browser and sent only to the provider it belongs to - directly, or through the relay above if you configured a proxy. Keys and proxy passwords are deliberately excluded from the backup export/import feature, so an exported backup file never contains them.
Models you install to run in-browser (WebLLM on WebGPU, or Chrome's built-in Gemini Nano) run entirely on your own device. Once a model is downloaded, using it for chat requires no further network traffic at all.
Installing a skill or marketplace entry fetches its files from GitHub or jsdelivr directly from your browser, the same way any other page asset would load.
This page reflects the app's current, actual behavior rather than a static legal document, so it is updated alongside the app itself. See the change log for a history of what shipped.
InBrowser is open source. Review the code yourself or raise a question at the repository, or visit the site.
Downloading InBrowser