Take full control of your privacy

No account passes this area. A revocable sign-in token also passes because it lets you move between devices without social login.

Prefer an account? Email/password or email sign-in passes; Google and GitHub do not.

Network privacy is not scored here. We do not check your VPN, Tor, or IP setup, so treat that as your own separate layer.

Monero (XMR) passes because it hides senders, receivers, and amounts on-chain.

Zcash (ZEC), Dash, Litecoin MWEB, and Zano also count as privacy-coin funding when they appear in deposit history.

Nano, Bitcoin, Ethereum, stablecoins, and other public-ledger crypto get partial credit; Stripe or card deposits fail this area.

Browser Private Mode on a private-capable TEE model gets a full pass because your browser verifies attestation before sending an encrypted request.

Selecting a model tagged “TEE” or “Private” without Browser Private Mode gets partial credit: it still uses confidential-compute routing, but it is not the strongest browser-encrypted path.

Standard provider models do not pass this area.

Names, contact details, addresses, account numbers and IDs become placeholders, and are restored in the reply. Images and files are sent as-is.

Tinfoil is the default in web chat and for new setups ($0.00021 per detection call plus $0.84 per million input tokens; only new, uncached text is billed, including overlap submitted across calls). It replaces them before the provider, memory or web search see your prompt, with detection in an attested enclave. Grepture is opt-in ($0.0005 per request, whatever its size). It covers only what is sent to the model provider and catches less: it looks for most names only in the first 4,000 characters.

The score treats PII redaction as on or off: chat redaction or API default redaction counts as on.

Placeholders can slightly change answers.

Passwords and other credential-like secrets become placeholders and are never restored — don’t paste secrets you need echoed back.

API key masking is separate and free. When it is on, NanoGPT’s own servers swap recognisable API keys in chat, Responses API, Decisions and supported legacy completions requests for placeholders before detection, memory, search or any provider reads them, and put them back in the reply and in tool calls your client runs. In reply text they stay masked inside URLs on hosts you didn’t send the key to, and web search, provider-hosted tools or connected tools in the web app keep the placeholder. Native Responses and the chat bridge are covered; hosted-tool credentials you deliberately supply, encrypted reasoning, signatures, correlation IDs and data URLs stay unchanged. The keys are never logged; NanoGPT keeps only three hourly totals across all accounts. It also covers private key files, passwords in database URLs, login tokens (JWTs and bearer tokens), crypto seed phrases and wallet keys, labelled payment card numbers and IBANs, and generated passwords and secrets in named fields, and each type can be turned off in settings. Text from files you attach in web chat is covered once it’s part of the message, as are plain-text document blocks and inline UTF-8 text files up to 3 MiB. It doesn’t cover images, embeddings, private (TEE) models or binary files passed to a provider as files, such as URL file parts, PDFs and Office files. Legacy completions cover string prompts and string arrays, except echo, logprobs, token-ID prompts and batched streaming. Unless you turn it on yourself, background and stored Responses API requests aren’t masked.

Local by default — history stays in your browser; nothing syncs unless you turn it on.

Passphrase or passkey sync passes the content-protection score because the sync key is user-held. Platform envelope encryption is partial because the server helps handle encryption.

Bring your own storage — point sync at your own S3-compatible bucket; we keep only the encrypted credentials.