Privacy Policy

Effective Date: August 10, 2026 · Application: TokForge - Local AI Chat

1. Overview

TokForge is a local-first AI chat application. This Privacy Policy describes how the application handles information. The short version: TokForge collects no data about you.

2. Data Collection

TokForge does not collect personal data, usage analytics, or telemetry.

No analytics
No telemetry
No automatic crash reporting
No advertising SDKs
No tracking of any kind

If the app crashes, the next launch may show a dialog asking whether to send a report. Nothing is sent unless you tap Send Report, and you can view the exact contents first. The report is a debug bundle that contains device and app details, your inference and sampler configuration, benchmark history, the names, sizes and file paths of your installed models, conversation summaries (identifiers, timestamps and coarse length buckets only, never titles and never message text), your settings with API keys, system prompt, persona and display name removed, recent application logs, and anything you type into the report form yourself. The app opens no network connection to send it: the bundle is handed to your own mail or share app, and you choose where it goes.

All data you create within the application (conversations, character cards, persona settings) exists exclusively on your device.

2.1. Opt-In Leaderboard Submissions

TokForge can submit a device benchmark result to the public TokForge speed leaderboard, but only when you turn on the leaderboard opt-in and explicitly submit a result. A submission contains only the device model and brand, the SoC model, the app version, the benchmarked model name, backend, and quantization, the measured prefill and decode speed, and total RAM rounded to the nearest GB. No user content, no prompt text, no model file paths, and no identifiers that could re-identify a person. Each submission is signed with a random token generated on your device (not derived from your hardware); the leaderboard service uses it only for rate limiting, it never appears on the public board, and it resets when you clear app data. Viewing the leaderboard fetches the public board and sends no data about you. If you never opt in and submit, nothing is ever sent.

3. Local Inference

All AI inference runs entirely on your device using one of two built-in backends:

MNN: A lightweight neural network inference framework running on-device
llama.cpp: A CPU/GPU inference engine for GGUF-format language models

Neither backend transmits any data off the device. Your conversations are never sent to any server operated by this application or its developer.

If you enable the Remote API feature (see Section 4), your prompts are sent to the server you configure.

3.5. Model and Content Downloads

When you search for or download models, TokForge connects to huggingface.co. Your search queries and device IP address are transmitted to HuggingFace's servers. HuggingFace's privacy policy governs this data.

Voice and helper models (neural voices, the on-device transcription module, and embedding models) are downloaded from HuggingFace when you install them in Settings or first use a feature that needs them. Automatic installation of text-to-speech voice packs is off by default.

Browsing the community character library connects to chub.ai. Searches you type there and character downloads are sent to that service, and character images are loaded from its content servers over HTTPS. Nothing is fetched until you open the browse screen or import a character.

3.6. Optional Online Features

These features can reach the network, and every one of them stays off until you turn it on or act:

Web search in chat: off by default. It requires a one-time consent plus a per-conversation toggle. When enabled, your search query (only the query, never your chat history, persona, memory, or documents) is sent to the engine you choose: DuckDuckGo Lite (default, no account needed), a SearXNG instance you configure, or Brave Search with your own API key.
Agent tools: agent tools that reach the network (web search, webpage fetch, weather, news feeds, public-IP lookup) require consent on the agent before they can run, and they run only when you run the agent. Only the tool's query parameters are sent, never your conversation.

4. Optional Remote API

TokForge supports an optional, user-configured remote API endpoint for inference. This feature is:

Entirely optional: the app is fully functional without it
User-controlled: you supply your own endpoint URL and, optionally, your own API key
Transparent: the app connects only to the URL you explicitly provide

If you choose to use a remote API endpoint, the privacy practices of that third-party service apply to requests sent to it. The developer of TokForge has no visibility into or control over those requests.

5. API Key Storage

If you provide an API key or token (for a remote endpoint, HuggingFace downloads, or Brave web search), it is stored in platform-secured storage: on Android via EncryptedSharedPreferences (backed by the Android Keystore system), and on iPhone and iPad via the iOS Keychain. The key is:

Encrypted at rest on your device
Never transmitted to any server other than the service you configured it for
Never accessible to the developer of this application

6. Third-Party SDKs and Libraries

TokForge uses open-source libraries including Ktor (networking) and Coil (image loading). Network activity occurs only for the optional features described in Sections 2.1, 3.5, 3.6, and 4. One bundled Google SDK, ML Kit text recognition, runs fully on your device to read text from video attachments: your images and video frames never leave the device, but when the feature is used the SDK shares technical diagnostics (device information, identifiers, and performance metrics) with Google, and this is not user-configurable. No other library collects telemetry or analytics.

7. Permissions

TokForge requests only the permissions necessary for its stated functionality. No permission is used to collect or transmit personal information.

Microphone: used for optional voice input. Speech-to-text is performed by your device's speech service; depending on your device and that provider, audio may be processed on-device or sent to the provider's servers under the provider's own privacy policy. TokForge itself never records, stores, or transmits your audio. The optional neural transcription module (Whisper) used for audio clips runs fully on-device.
Internet: used only for the optional features described above: model and voice downloads, remote API connections, opt-in leaderboard submissions, community character browsing, web search and network agent tools, and the opt-in control API server. No background network activity occurs unless you enable or use these features.

8. Data Retention and Deletion

All application data is stored locally on your device. To delete all data associated with TokForge:

Uninstall the application: this removes all app data from your device
Clear app data: navigate to Settings > Apps > TokForge > Storage > Clear Data

The developer has no copy of your data and cannot delete it on your behalf because it is never received.

9. Children's Privacy

TokForge does not knowingly collect any information from anyone, including children under the age of 13. Because no data is collected, no special handling for children's data is required.

10. Changes to This Policy

If this Privacy Policy is updated, the new version will be published at the same URL with a revised effective date. Material changes will be noted in the application's release notes.

11. Contact

For questions about this Privacy Policy, contact: [email protected]