---
title: Local-first & private by design
weight: 9000
extra:
  summary: "Where your data lives (on your device), how secrets are kept out of it, and what does — and doesn't — leave when you turn on sync."
  status: Shipped
---

Bring Your LM keeps your data on your device. Your agents, providers,
conversations, and notes live in a local database on the device, and nothing is
sent anywhere unless you deliberately turn on sync.

## Why it matters

You bring the model and the keys, so the app's job is to hold your configuration
and history without quietly shipping it to a backend. There's no BYLM account and
no server you're required to trust — the default is local.

## Where things live

- **The main data** — agents, providers (minus their secrets), conversations and
  messages, tools, notes, and attachments — is stored in a local database on your
  device.
- **Secrets** — provider API keys and any fetch-tool API key — are kept out of
  that database entirely, in your operating system's secure keystore (Keychain,
  libsecret, or the Android Keystore). They're written there when you enter them
  and read only when a request actually needs them.
- Secrets are never shown back to you in a tool's or provider's saved
  configuration, and never handed to the model — a tool only tells the model
  whether a secret is _set_ or _unset_, never its value.

## What leaves the device

By default, nothing. There's no telemetry backend and no account.

When you talk to a **hosted** provider, your prompt necessarily goes to that
provider — the app warns you before saving a hosted provider that prompts will be
shared with that third party. A local-server or embedded provider keeps prompts on
hardware you control.

**Sync is opt-in and off** until you set it up. If you enable it, the app
replicates your data to a Couchbase server you point it at — one you run — so your
history can follow you across devices. Even then your secrets stay in the OS
keystore and never travel over the sync connection, and a few things that only
make sense on one device (embedded-model file locations, per-device runtime
settings) are kept local too.

## What it doesn't do yet

The local database itself is **not encrypted at rest** today — it relies on your
device's own protection (lock screen, full-disk encryption) for the file on disk,
while the sensitive secrets are held separately in the OS keystore. If you enable
sync, the collections you replicate travel to the server you configured, so point
it at one you trust.