# Privacy: what leaves your browser

> What stays in the browser, what each feature sends and to whom, the rows Direct Connection takes off the server path, and what the hosted app measures.

- Canonical: https://big-agi.com/docs/privacy-data-flow
- Minimum tier: open  [Open ⊂ Free ⊂ Pro - a tier only ever ADDS to the Open baseline]
- Kind: reference · Last content update generation: 2026-07-27 · Review by: 2026-11-21
- Answers: Does my attachment get uploaded to your server? · Does voice audio leave my device? · What analytics does Big-AGI collect about my use?

What stays in the browser, in two stores:

| Store | What it holds |
|---|---|
| Local storage | API keys and models, all settings and configuration |
| IndexedDB | chats and larger local files; on the hosted app also persona, ramble and notification entities |

> **Direct Connection works only with your API key stored in the browser**, and with an AI service that permits direct browser calls (CORS). Where it cannot be used, requests route through the Big-AGI fast edge servers instead - everything still works, within the standard upload size and time limits.

One row per feature, the ones that never reach Big-AGI grouped at the bottom:

| Feature | Route |
|---|---|
| Chat message - text, history, system prompt \* | browser -> Big-AGI edge -> AI service |
| Attachments - the bytes travel inside the message \* | as the chat message: inlined into the request body, no separate upload endpoint |
| Attach from Google Drive | browser -> Google, direct: your tab downloads it with your Google token, our servers never see the file |
| Files the model made \* | browser -> Big-AGI edge -> AI service, on your key |
| Model list refresh \* | browser -> Big-AGI edge -> AI service |
| Voice input, recorder engines - hosted app | browser -> the transcription vendor, always: audio files never traverse our server |
| Voice output, hosted voices | text -> Big-AGI edge -> the voice vendor |
| Attach a link, page browsing | URL -> Big-AGI server -> the page: a browser we run fetches it, so the site sees our address, not yours |
| YouTube transcript | video id -> Big-AGI edge -> YouTube; Direct Connection does not move this row |
| Web search | query -> Big-AGI edge -> the search API |
| Location for web search - off until you turn on **Location** | coordinates -> `nominatim.openstreetmap.org`; only the city, region, country and timezone it returns ride the model request |
| Image generation | prompt and any input images -> Big-AGI edge -> the image vendor |
| PlantUML diagrams - drawn as soon as the block appears | the diagram source -> `plantuml.com`, from your browser |
| Publish or share a conversation - hosted app | the conversation is copied to our server when you ask for a link - an explicit act |
| Product analytics | hosted app only - see [Analytics](#analytics) |
| Voice input, browser engine | your browser's own speech service (in Chrome, Google's), never Big-AGI |
| Voice output, browser voice | local only - your browser's own speech synthesis, no network to us |
| Attachment conversion - PDF text, PDF to images, OCR, DOCX and HTML to Markdown | local only - the PDF and OCR engines run in your browser |
| Chat search | local only - keyword matching over your local text, no embeddings, no server query |
| Token count and cost estimate | local only - the tokenizer runs in your browser |

\* skipped with [Direct Connection](/docs/feature-direct-connection) on, per service: the Big-AGI edge drops out and your browser calls the AI service itself.

On Open the two rows marked hosted app change. Every microphone is your browser's own speech service, and a share link exists only where the operator configured storage for it.

Upload size and time limits on the server path live on [Context and limits](/docs/context-and-limits).

The default route, in three lanes. **Your Control** holds the browser with your data and keys. **Transit Only** is the Big-AGI edge, and **AI Provider** is the model service. The request carries the key out through the edge; the response comes back the same way.

![Three-lane sequence diagram. Your Control holds the browser with your data and keys. Transit Only is the Big-AGI edge. AI Provider is the model service. Request plus key goes from browser to edge, the edge forwards it to the AI Services box, and a dashed response arrow returns through both.](/docs/legacy/data_ownership_hosted.png)

## Analytics

Analytics need keys compiled into the build, and an Open build has none, so a self-hosted instance reports nothing. [What your instance reports](/docs/self-host-configuration#what-your-instance-reports) has the detail. The hosted app runs four systems:

| System | What it sends |
|---|---|
| PostHog, in the browser | Events the app defines - feature used, model, timings - plus the library's own automatic capture: page views, clicks, JavaScript errors. A recorded click carries the text of the element clicked. Served from our own domain, under `/a/ph` |
| PostHog, at the edge | Two events per generation, `aix_chat_generate_started` and `aix_chat_generate_completed`: which AI service and model, token counts, timings, how the turn ended, and your IP address. Keyed to your account; signed out, to `anonymous` |
| Google Analytics 4 | Page views, plus five account events sent from our server: `sign_up`, `login`, `begin_checkout`, `purchase`, `subscription_renewal` |
| Vercel Analytics | Page views, from the hosting platform |

The events the app defines carry metadata only; the rule in code is "never transcript text, titles, or topic labels". The same rule withholds vendor error text, because an error string can echo a fragment of a key. The identity attached to the events is deliberately thin: no email address, no display name, no picture, no storage figures, no per-device identifier.

Account events are the one exception on email. The server may attach a SHA-256 hash of it, withheld for the European Economic Area, the UK and Switzerland. The plaintext address never leaves that function. Arriving from an ad writes `agi.att`, a first-party cookie on `.big-agi.com` that holds the click id for 90 days, read again at checkout. [big-agi.com/privacy](https://big-agi.com/privacy) is the disclosure of record.

The hosted app has no analytics switch today.

## Read the literal request

The [AI Inspector](/docs/feature-ai-inspector) captures the exact JSON body that left your browser for a turn. That body holds the assembled system prompt, the history as sent, the model and its parameters. A transport chip names the route it took, **Direct Connection** or **Edge Server**.

> **Pro:** Chats, personas and rambles stay on this device and browser only, unless you subscribe to Pro: cloud backup and multi-device sync (1 GB). On Open there is no sync. Disabling sync never deletes local data.

## Related

- [The AI Inspector](/docs/feature-ai-inspector)
- [What Direct Connection does](/docs/feature-direct-connection)
- [Context and limits](/docs/context-and-limits)
- [Keep your key safe](/docs/key-storage)
- [Back up, restore and import](/docs/account-backup)