Local-first & private by design

Shipped

Bring Your LM keeps your data on your device. Your agents, providers, conversations, and notes live in a local database on the device, and nothing is sent anywhere unless you deliberately turn on sync.

Why it matters

You bring the model and the keys, so the app's job is to hold your configuration and history without quietly shipping it to a backend. There's no BYLM account and no server you're required to trust — the default is local.

Where things live

• The main data — agents, providers (minus their secrets), conversations and messages, tools, notes, and attachments — is stored in a local database on your device.
• Secrets — provider API keys and any fetch-tool API key — are kept out of that database entirely, in your operating system's secure keystore (Keychain, libsecret, or the Android Keystore). They're written there when you enter them and read only when a request actually needs them.
• Secrets are never shown back to you in a tool's or provider's saved configuration, and never handed to the model — a tool only tells the model whether a secret is set or unset, never its value.

What leaves the device

By default, nothing. There's no telemetry backend and no account.

When you talk to a hosted provider, your prompt necessarily goes to that provider — the app warns you before saving a hosted provider that prompts will be shared with that third party. A local-server or embedded provider keeps prompts on hardware you control.

Sync is opt-in and off until you set it up. If you enable it, the app replicates your data to a Couchbase server you point it at — one you run — so your history can follow you across devices. Even then your secrets stay in the OS keystore and never travel over the sync connection, and a few things that only make sense on one device (embedded-model file locations, per-device runtime settings) are kept local too.

What it doesn't do yet

The local database itself is not encrypted at rest today — it relies on your device's own protection (lock screen, full-disk encryption) for the file on disk, while the sensitive secrets are held separately in the OS keystore. If you enable sync, the collections you replicate travel to the server you configured, so point it at one you trust.