Privacy
Privacy policy 1.9.6: three security fixes, each with its limit
Encrypted memory now reaches the model only in chats with memory on. Vault chats are refused on unconfirmed routes. Container network credentials are bound to their container. Each fix has a stated limit.
Encrypted memory entries now go to the AI model only in chats with memory on, and you see how many. Vault chats are refused on routes without a confirmed retention commitment. Nothing to accept again.
Three security fixes ship together with privacy policy 1.9.6. Each one has a limit, and we state it.
Encrypted memory. The optional encrypted memory protects stored entries, but entries in use go to the server and the model provider in plain text. Until now your browser sent them with every message of a chat, even when memory was off for that chat. That was wrong. Now entries go along only when memory is on for the chat. The chat shows how many entries were sent, and a browser setting turns sending off. Setup can no longer overwrite an existing key, passphrases need at least 12 characters, new entries are bound to their row, the key is cleared at sign out, and the plain text vector search is gone. The memory still protects storage only. It is not end to end.
Vault chats. A chat that holds credentials is now refused, with no network call, on any route whose zero data retention commitment is not confirmed. It never switches to another provider on its own. Featherless counts as confirmed through its written commitment of 28 September 2026. That is the provider's statement, not something we enforce technically. You can allow it manually for one chat, and the chat then shows that the override is active.
Container network access. Each container's credential for the egress broker is now bound to that container. Unknown container types are refused, credentials of deleted or offloaded containers are rejected, and we can rotate the credential of a single workspace. One gap remains: containers on worker nodes reach the broker through a tunnel without a readable name, so they are not yet checked by name.
The privacy policy, version 1.9.6, says all of this.