Data Retention and Visibility

Nito Stores Nothing

Prompts, responses, reasoning, tool payloads, attachment contents, and attestation evidence are used to serve the request and are never stored. Conversation history lives on your device: encrypted in your browser for the Browser App, in a dedicated Nito profile on your machine for Plugin sessions. A record of each call, with no content in it, is kept to run and bill the service: the account, the model, the privacy level, token counts, cost, latency, and time. Product analytics keep the same fields for 180 days.

What the Provider Keeps

Level	The provider running the model
Anonymous	Handles the request under its own terms, which may include retention. It sees a request from Nito, with no identity attached.
Private	Required to keep nothing. Nito sends every call with the provider’s zero-data-retention setting on, and lists a model at Private only where the provider offers that setting.
Confidential	Cannot read it. The model runs inside sealed hardware its operator cannot read into.
Encrypted	Cannot read it, and the prompt is encrypted through Nito as well.

Who Can See What

Retention is separate from visibility. Who sees a prompt depends on the surface.

Party	Sees your prompt when	Does not see it when
Your browser	Always, in the Browser App. Classic chats are saved there, encrypted. Incognito chats are not saved
Your harness (Claude Code or Codex)	You use `ask`	You use `private` or a Nito-routed `session`
Your application (API)	Always
Nito	Any request, in transit only. At Encrypted, Nito relays ciphertext it cannot read
The provider	It serves the call, subject to the model’s level	At Confidential and Encrypted it runs the model inside sealed hardware
A search provider	Web search or fetch is on for that request	The tools are off

Keeping a prompt from your harness is about the command. Keeping it out of your browser history is about Incognito chat. Keeping it from the provider is about the model’s level.

Web Search and Fetch

Nito runs web search and fetch as its own step before the model call, then strips the tool, so the model call keeps its privacy level. The search query is generated from your prompt, redacted of secrets, email addresses, phone and card numbers, network addresses, and long numeric IDs, then sent to a search provider. The redaction is pattern-based and best-effort: free-form context from the prompt can still appear in the query. Turn the tools off for a prompt when that matters. At Encrypted, hosted search and fetch cannot run inside the encrypted request, so the Browser App grounds the prompt with a browser-side step before encrypting. See Encrypted.

Confirming It

A Confidential or Encrypted call produces attestation evidence you can verify. See How Attestation Works.

Privacy Levels

The four levels.

Privacy in the Browser App

Classic and Incognito chats.

What Each Command Protects

The Plugin, command by command.

​Nito Stores Nothing

​What the Provider Keeps

​Who Can See What

​Web Search and Fetch

​Confirming It

​Related