Is a BYOK AI assistant private?

What BYOK actually changes

In a bundled AI product, your prompt goes to the vendor's server, which then calls a model provider. Two organisations see your data, and you have a relationship with only one of them.

With BYOK, your prompt goes from your machine to your provider. One organisation sees it, and it is one you chose and have terms with. That is a real improvement, and it is a smaller one than private implies.

The one exception is a router such as OpenRouter, which puts a hop back in. Your prompt goes from your PC to OpenRouter, which is the provider you configured, and OpenRouter can pass it on to the operator of the model you chose, under its own terms and policies. Nothing goes through BediniLabs either way, but more than one organisation can see the request, so read OpenRouter's policies and those of the models you route to. Connecting SideNote Pro to OpenRouter covers the sign-in itself.

What stays on your machine

Everything SideNote Pro persists lives under %LOCALAPPDATA%\SideNote Pro\, with no cloud copy of any of it.

API keys are never written into settings.json. Folder indexing, extraction, search and ranking are entirely local, with no network call. The usage ledger holds counts, dates, provider and model provenance and cost aggregates, never prompts, responses, filenames, document contents or image data. Exports are written only where you save them and are plain text even with history protection on: a settings export holds your prompts, writing context, endpoints and folder paths but no API key, and Export all conversations holds your conversations unredacted.

Settings › Usage & cost

What leaves the machine, and when

When you press Send, or Tab to run an inline command, a request goes to the provider you configured. Depending on what you attached, it can carry:

• your prompt, and the system prompt from Settings;
• recent conversation context, and the compaction summary when one exists;
• text captured by a selected-text action;
• text typed after an inline command's trigger, with the command's instruction and your writing context;
• text extracted locally from attached documents;
• image data from attachments and screenshots, and PDF pages you chose to send as images;
• Active Notes you attached to that message;
• the folder excerpts local retrieval selected.

Context compaction is an additional provider call: it asks your model to summarize older messages when a thread outgrows its context window. It is still your provider and your key, and it means older conversation content is sent to the model to be summarised.

Another is optional and off by default: Automatic Takeaways. Switched on, it sends a separate request after each response finishes, carrying that exchange and a few earlier messages as text, to the provider that wrote the response or to the profile you chose for Takeaways. It never sends images, documents, captured text, folder excerpts or your notes, and saving a Takeaway yourself sends nothing.

What SideNote Pro never does

• No telemetry or product analytics.
• No user account, and no advertising.
• No cloud conversation storage and no cross-device sync.
• No background screen capture, microphone listening, camera access or clipboard polling.
• No automatic file or folder discovery, and no background filesystem watcher.
• No embeddings and no vector database, so your corpus is never sent to an embedding service.
• No queries against your provider's billing system.

Screenshots, clipboard images and selected text are read only after an explicit action: starting a capture from the composer or with the capture shortcut, pressing Ctrl+V, or pressing the Selection actions shortcut or an action's shortcut. Writing, floating and capturing Active Notes sends nothing.

Inline commands are the one feature that watches typing, and only while you have switched them on: SideNote Pro looks for the start of one of your triggers and keeps nothing else of what you type. They are off by default.

What BediniLabs receives

The licensing service answers one question: is this installation entitled to run. It handles trial authorization, activation, entitlement refresh and device deactivation, and stores licensing and device metadata to do so.

It does not receive prompts, responses, attachments, screenshots, filenames, folder contents, usage figures or your provider API key. Your AI requests do not pass through it, and it is not a proxy for your provider. Activation keys are sent when you activate and are not persisted locally afterwards.

From version 1.15.1, a daily update check also downloads one public file from sidenotepro.com to see whether a newer version is out. It sends no licence key, identifier, settings or content; the website sees only what any visit shows it, such as the IP address and the time.

The full policy is on the privacy page.

If you need content never to leave the machine

Configure a local provider. With Ollama or LM Studio, SideNote Pro sends AI requests to localhost, where inference runs on your hardware. That keeps SideNote Pro's AI requests off a hosted provider; its separate licensing communication with BediniLabs still occurs.

Two caveats. SideNote Pro does not supply the local model and cannot guarantee the behaviour of third-party software; what it controls is the destination of the request. And local models are generally less capable than the best hosted ones, so this is a real tradeoff rather than a free upgrade.

You can keep two profiles: hosted for ordinary work and local for confidential work, switched from the composer. See using local models for private workflows.

If you use Automatic Takeaways with that pattern, leave Provider for takeaways on Same as conversation, so a conversation held on the local model is also checked by it. A hosted profile chosen there receives the checks of every conversation, local ones included.

A checklist for evaluating this yourself

1. Read your provider's data retention and training policy. This is the largest factor and it is entirely outside SideNote Pro's control.
2. Check whether your provider offers a zero-retention or enterprise tier if your work requires one.
3. Decide which categories of content you are willing to send to a hosted provider at all.
4. Configure a local provider for the categories that fail that test.
5. Turn on conversation history encryption if the machine is shared or portable.
6. Set a retention period so old threads do not accumulate indefinitely.
7. Check the composer's profile picker before sending anything sensitive.
8. If Automatic Takeaways is on, check which provider receives its checks under Settings › Takeaways.
9. Keep exported conversations and settings files somewhere private: they are not encrypted.