MyLLM — Privacy Policy

Last updated: October 27, 2026 Effective date: October 27, 2026

Summary

MyLLM is private by default, and we — the developer — never collect your conversations or personal data. No analytics, no telemetry, no crash reporting and no accounts. The only server of ours the app talks to is the MyLLMos app gallery, which receives a random install ID and nothing about you or your chats (see section 2.11).

Out of the box, everything stays on your device and your local network. MyLLM also offers optional features you can switch on — cloud AI providers (using your own key), Confidential Inference, image generation, internet tools such as web search, and services you connect (MCP servers and Connectors) — which send data to third parties you choose. That data goes directly from your device to those services under their own privacy policies; it never passes through us.

This policy explains exactly what goes where.

1. Data Collection

We collect no personal data. MyLLM has no analytics, no telemetry, no crash reporting and no user accounts. Our only server is the MyLLMos app gallery described in section 2.11.

Specifically, MyLLM does not collect:

• Personal information (name, email, phone number, address)
• Device identifiers (IDFA, IDFV, serial numbers)
• Usage analytics or behavioural data
• Crash logs or diagnostics sent to us
• Location data
• Browsing or search history
• Financial or payment information

2. How the App Works

MyLLM is a client application. By default it processes data on your device and your private network; optional features can send data to services you choose. Understanding the modes is key to understanding the privacy model. In every case, your data never passes through us.

2.1 Server Mode (Ollama, LM Studio, Custom)

In server mode, MyLLM connects to a Large Language Model (LLM) server that you operate on your local network — typically a computer in your home or office running software such as Ollama or LM Studio.

• Your messages are sent from the MyLLM app on your iPhone/iPad to your own server over your local network (e.g., 192.168.x.x).
• AI responses are generated by the LLM running on your server and returned to the app over the same local connection.
• No data leaves your network. The communication path is: your iPhone → your WiFi router → your computer. At no point does any data pass through our servers, cloud services, or the public internet (unless your server is intentionally configured to be internet-accessible, which is your responsibility).
• Tool results (web searches, file contents, contacts, calendar events, photos) are retrieved by the app on-device and sent to your local server for processing. They are never sent to us.

2.2 On-Device Offline Mode

In offline mode, MyLLM runs a language model directly on your iPhone or iPad using the llama.cpp inference engine with Metal GPU acceleration.

• Model files are downloaded from Hugging Face (huggingface.co) to your device's local storage. This is the only external network request the app makes in offline mode, and only when you explicitly tap "Download." Hugging Face's own privacy policy governs that download.
• After download, no internet connection is needed. All inference runs entirely on your device's processor and GPU.
• Your messages and responses never leave the device. There is no server involved.

2.3 Cloud AI Providers (Optional — Your Own Account and Key)

MyLLM can connect to third-party cloud AI providers if you choose to add your own API key. Supported providers include OpenAI, Anthropic, Google (Gemini), OpenRouter, Groq, and any other OpenAI-compatible endpoint.

• This is entirely opt-in. The default is a local server (Ollama/LM Studio) or on-device offline mode. You must deliberately select a cloud provider and enter a key.
• When a cloud provider is selected, your messages and the tool results needed to answer them are sent over HTTPS directly from your device to that provider to generate responses.
• That data is governed by the provider's own privacy policy and terms — please review them. It is not sent to us.
• Your API key is stored in the iOS Keychain (encrypted at rest) on your device. We never receive your key, your prompts, or your responses.
• We do not proxy, log, or intercept this traffic. It travels from your device to the provider and back.

2.4 Confidential Inference (opticell) — Beta, Opt-In, Off by Default

Confidential Inference is an experimental beta feature that is off by default. When you enable it and use a remote confidential node:

• Your prompt is processed inside a hardware-attested secure enclave (a Trusted Execution Environment) on that node.
• Before any data is sent, MyLLM verifies the node's hardware attestation on your device, so you can confirm it is running in a genuine secure enclave (shown as a "verified private" badge).
• The design goal is that the node operator cannot read your data; verification happens on your device.
• This feature is beta and experimental — do not rely on it for highly sensitive data. If you leave it off (the default), it has no effect and changes nothing.

2.5 Image Generation (Optional — Your Own Server)

If you configure your own image-generation server (ComfyUI) in Settings, image prompts — and, for image editing, the source image you provide — are sent to that server, which you operate. There is no default or shared image server run by us. With no server configured, image generation is simply unavailable.

2.6 Large Language Models (LLMs)

MyLLM does not provide or operate any AI model. The app is a client that connects to models you choose to run:

• In server mode, the model runs on hardware you own and control. The model's behaviour, capabilities, and any data it processes are governed by your server configuration and the model's license.
• In offline mode, small open-source models (such as SmolLM, Qwen, TinyLlama) run directly on your iPhone. These models are open-weight and do not phone home or transmit data.
• In cloud mode (if you opt in), the model runs on the third-party provider you selected, under their terms.
• We have no access to the prompts you send, the responses you receive, or any data processed by the model — wherever it runs.

2.7 What the AI Can Access (With Your Permission)

When you grant iOS permissions, the AI agent can access:

• Contacts — to search and look up contact information on your behalf
• Calendar & Reminders — to view and create events and reminders
• Photos — to browse and save images
• Microphone — for voice input (speech-to-text processed by iOS on-device)
• Camera — to capture photos to share with the AI
• Files — to read, write, and manage documents in the app's sandbox

This data is gathered on-device. Where it is then sent for processing depends on the mode you have chosen above — your own local server, on-device offline, or (only if you opted in) a cloud provider or confidential node. It is never sent to us.

2.8 Internet Tools (Web Search, News, and More)

When you ask MyLLM to use an internet tool, the app makes standard HTTPS requests directly from your device to third-party services. These tools include:

• Web search and URL fetching
• News headlines
• Image search
• Patent lookup (European Patent Office — Open Patent Services)
• Translation

Each request comes from your device's IP address and is subject to the privacy policy of the service contacted. We do not proxy, log, or intercept them. The results are then handed to whichever model you are using (local, on-device, or — if you opted in — a cloud provider/confidential node).

2.9 Mini-Apps (MyLLMos)

MyLLM can save and run small HTML/Python "mini-apps" on your device in a sandboxed web view. By default these run fully offline. You can grant per-app permissions:

• App network access — lets a mini-app make outbound internet requests (via a bridge you can disable globally at any time).
• App intelligence — lets a mini-app ask the on-device AI.
• App storage — each mini-app gets its own local, on-device storage.

These permissions are off unless you enable them, and we receive nothing from mini-apps.

2.10 Server Terminal

The Server Terminal feature allows you to manage your Ollama server (pull, delete, inspect models) remotely from your iPhone. All commands are sent directly from your device to your server over your local network. We have no visibility into these operations.

2.11 MyLLMos App Gallery (Our Server)

When you open the MyLLMos gallery or install an app from it, MyLLM contacts our gallery server (gallery.optidns.uk, run by Opticell Ltd) to fetch the list of apps and the app you chose. Each request carries:

• A random install ID — a number MyLLM makes up the first time it starts the gallery. It is not your name, Apple ID, email or device identifier, and it is not linked to them.
• An Apple App Attest check — proof from Apple that the request comes from a genuine copy of MyLLM, so the gallery can't be scraped or abused. It contains no personal information.
• Which app you are downloading, and which platform (iOS, Mac).

As with any web request, the server also sees your IP address. We use this only to deliver the gallery, protect it from abuse and count how often each app is installed. We do not sell it, share it, use it for advertising, or combine it with anything else. Your conversations, files and the data inside the apps you install are never sent to the gallery.

2.12 MCP Servers and Connectors (Optional)

You can connect MyLLM to services that speak the Model Context Protocol — your own servers, or hosted services listed under Settings → Connectors (for example a notes, project or design service). This is off until you add one.

• When the AI uses a connected service's tool, the request goes directly from your device to that service, under its own privacy policy.
• If the service needs you to sign in, you do so on the service's own sign-in page. The resulting access token is stored in the iOS Keychain on your device; we never receive it.
• Tools that change something on a service ask for your OK first.
• The list of available Connectors is downloaded from our public GitHub repository; fetching it sends nothing about you.

2.13 Shared Lists (iCloud, Optional)

Some MyLLMos apps (such as Shopping List and Quick Todo) can keep a list in your own iCloud account and share it with people you invite. The lists are stored by Apple in your private iCloud database and shared through Apple's iCloud sharing; we cannot see them. Nothing is stored in iCloud unless you use this feature.

2.14 Working on Your Files and Code (Optional)

Work on a Document and Work on Code let the AI read and change files in a folder you choose. The folder's contents are read on your device and sent only to the model you have chosen (see section 2). Changes are saved into your folder, and a copy of each original is kept on your device so you can undo them.

2.15 Subscriptions and Purchases

Subscriptions and purchases are handled entirely by Apple through the App Store. MyLLM asks Apple whether you have an active subscription; we never receive your payment details, name or Apple ID.

3. Data Storage

All app data is stored locally on your device:

• Conversations — saved in the app's sandboxed documents directory
• Memories — user-taught facts stored in local JSON files
• Workflows — automation definitions stored locally
• Mini-apps — saved HTML/Python apps and their local storage
• Downloaded models — GGUF files stored in the app's documents directory
• Settings — stored in UserDefaults; secrets (cloud provider and custom-server API keys) in the iOS Keychain

Nothing is backed up to our servers. The only data kept in iCloud is a shared list you choose to create (section 2.13). If you delete the app, all data is permanently removed from your device.

4. Third-Party Services

MyLLM does not integrate with any third-party analytics, advertising, crash reporting, or tracking services. Specifically:

• No Google Analytics, Firebase, or Crashlytics
• No Facebook SDK or Meta tracking
• No ad networks or attribution services
• No Mixpanel, Amplitude, or similar analytics
• No Sentry, Bugsnag, or similar error reporting

The only network requests the app makes are the ones you initiate or configure:

In every case, the request goes directly from your device to the destination. Apart from the app gallery, none of it reaches us.

5. Children's Privacy

MyLLM does not knowingly collect personal information from anyone, including children under the age of 13. The gallery's random install ID is not linked to any person.

6. Security

• All local storage uses iOS sandboxing (no other app can access MyLLM's data)
• API keys (cloud providers and custom servers) are stored in the iOS Keychain, which is encrypted at rest
• Cloud-provider and Confidential Inference traffic uses HTTPS (encrypted in transit)
• Local network communication with your own server may use standard HTTP (not HTTPS) because local LLM servers typically do not present TLS certificates. This traffic does not leave your local network.
• On-device inference processes all data in-memory with no external transmission

7. Your Rights

We hold no personal data about you. The gallery's install records are tied only to a random ID; to have them removed, email us (below) — or delete the app, which discards the ID for good. Your local data exists only on your device and is fully under your control.

If you opt into a cloud provider or a confidential node, data you send to that third party is governed by their privacy policy, and any rights you have over it are exercised with them.

To delete all app data: delete the MyLLM app from your device. This removes all conversations, memories, workflows, mini-apps, settings, and downloaded models permanently. To stop using cloud features, remove the API key or switch back to a local/on-device model in Settings.

8. Changes to This Policy

If we update this privacy policy, we will post the new version within the app and on our website, and update the "Last updated" date above. Changes typically relate to new features and how data is handled.

9. Contact

If you have questions about this privacy policy:

• Email: myllm@opticell-limited.com

MyLLM is designed from the ground up with a simple privacy principle: your data is yours. We never see it, we never touch it, and we never want to. Anything that leaves your device does so only because you chose to turn it on — and it goes to the service you picked, not to us.