> ## Documentation Index
> Fetch the complete documentation index at: https://docs.trynito.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Privacy in the App

> Privacy levels, Incognito chats, and where your data lives.

Two separate things protect a conversation. The **privacy level** is how a request reaches the model. An **Incognito chat** is whether the conversation is saved in your browser.

## Privacy Levels

The picker shows each model's level on its row.

| Level | Description (each level builds on the last) |
| :- | :- |
| **Anonymous** | Frontier models, with no identity attached to the request. |
| **Private** | Open-weight models with zero data retention upstream. |
| **Confidential** | Runs inside sealed hardware, with attestation you can verify on every request. |
| **Encrypted** | Runs inside the same sealed hardware as Confidential, with prompt and response encrypted on your device on the way in and out. |

All four are available in the Browser App. Pick a model once and its level applies to every message in the chat. Full definitions and what each level protects: [Privacy Levels](/privacy/levels) and [How Privacy Works](/privacy/overview).

Nito stores nothing you send or receive, at any level. The [Receipt](/web-app/receipts-and-proof) on each reply records the level that ran.

## Incognito Chats

An Incognito chat is never saved. Refreshing or closing the tab erases it. It stays out of history, search, Knowledge, and sharing, and sits in the **Incognito (not saved)** slot in the rail while open. Start one from **+ New**, or make it the default with **Start new chats as incognito** in Settings.

An Incognito chat can run at any privacy level.

## Where Your Data Lives

* **Chat history, folders, and Workbench items** are encrypted in your browser with a key that stays in this browser. Nothing is stored on Nito's side.
* **Encrypted backups** (Plus and up) and **Live sync** (Advanced and up) move that data between devices as ciphertext protected by your passphrase. See [Backups and Sync](/web-app/backups-and-sync).
* **Browser memory**, when on, stores facts from your chats, encrypted on this device. See [Memory](/web-app/memory).
* **Attestation evidence** on Confidential and Encrypted replies is kept inside the encrypted chat record so you can export it later.
* **Purge chat data** in Settings under Storage removes local chats, folders, and Workbench data. Signing out does not.

## Protected History

A chat remembers the strongest level it has used. Once it holds Confidential turns, Anonymous and Private rows read **Incompatible**; once it holds Encrypted turns, only Encrypted rows stay selectable. Start a new chat for a weaker route. The same rule applies to Fusion drafts and the summary model.

## Encrypted in the App

* Replies arrive whole rather than streaming; they are decrypted in your browser first.
* Attachments are parsed in the browser. **Auto** parser mode is hidden, and **Server** warns that the server sees the file before encryption.
* Raw image uploads are not sent on Encrypted routes yet.
* Web Search and Web Fetch run through a browser-side helper before the request is encrypted. See [Web Search and Tools](/web-app/web-search-and-tools).
* Fusion synthesis is an explicit step you trigger. See [Fusion](/web-app/fusion).

## Next

<CardGroup cols={2}>
  <Card title="Privacy Levels" icon="layer-group" href="/privacy/levels">
    The four levels in depth.
  </Card>

  <Card title="Data Retention and Visibility" icon="eye-slash" href="/privacy/data-retention-and-visibility">
    Who can see what.
  </Card>

  <Card title="Receipts and Proof" icon="receipt" href="/web-app/receipts-and-proof">
    Verify a reply.
  </Card>

  <Card title="Backups and Sync" icon="cloud-arrow-up" href="/web-app/backups-and-sync">
    Your data across devices.
  </Card>
</CardGroup>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.