Privacy and storage
Product-specific data flows, local storage, and deletion boundaries.
Local-first storage does not mean that all processing happens on your device. Cloud models receive the content you submit; a self-hosted Gateway receives requests routed through it; external CLI agents follow their own network and storage policies.
Data flows by product
| Product | Local or operator-controlled data | Network boundaries |
|---|---|---|
| Chrome | Conversations, library data, settings, and locally protected provider credentials in extension storage | Selected context and prompts go to the configured AI provider after cloud consent. Cloud TTS sends the text to its provider. Model downloads and explicitly requested link checks also make network requests. |
| Desktop | Workspace files, application state, runtime/session data, browser site data, and the password vault on the computer | The embedded browser loads the sites you visit. CLI agents, Git operations, and other tools can also contact external services; each has its own authentication and data handling. |
| Mobile | Conversations in the local database, preferences, attachments, and keys in platform secure storage | Prompts and supported images go to the chosen model provider. Android voice input uses the device's speech-recognition service, whose processing can depend on the installed service. |
| Gateway | Upstream credentials, users, balances, usage, and audit data in your deployed services | The gateway forwards supported requests upstream. Configured observability exporters can send operational data to your chosen observability deployment. |
Chrome's cloud-consent control applies to cloud AI/TTS requests. It is not a universal firewall for every network operation. Mobile's onboarding explains provider data use. Gateway access and retention are controlled by the instance operator, including its member accounts and observability settings.
Deletion has a scope
- Chrome: export and cleanup are separate operations. Data Management cleanup preserves bookmarks, and deleting API keys is a separate choice. Follow the Chrome privacy guide for data management, consent, and permissions.
- Desktop: browser site data, saved passwords, application data, project files/worktrees, and external CLI credentials have separate controls and locations. Removing one does not erase the others; follow the Desktop privacy guide.
- Mobile: use the application's data controls described in privacy and security. Platform-specific cleanup and verification limits still apply.
- Gateway: database retention, backups, billing records, and observability stores are operator responsibilities. Deleting local client history does not delete server-side records.
Deleting data in Cordy cannot delete copies already processed by a provider, exported to a file, or retained in a backup. Review the selected provider's policy and your own server configuration.
Verification limits
This documentation describes the checked source and recorded product evidence. It does not certify a deployment or platform. In particular, Mobile's iOS binary execution remains unverified, and its release baseline records open Android camera/share-in/voice/accessibility checks. See each product's guide for the applicable limits.