Last Updated: September 10, 2026

MewyAI (the “App”) is an independent third-party client for large language model APIs that uses a Bring Your Own Key (BYOK) model. This Privacy Policy explains how the current version stores, transmits, and deletes data when you use its features.

1. Data Collection and Storage

• API keys and other credentials: Provider API keys, MCP authentication credentials, and custom headers identified as sensitive are stored in the iOS Keychain on your device, with protection that permits access only while the device is unlocked and restricts them to that device. The App does not enable iCloud Keychain synchronization for these credentials.
• Local content: Regular chat history, unsent drafts, attachments, original images and editing strokes, memories, history summaries, knowledge-base extracted text, chunks and vector indexes, model configurations, and preferences are stored in local app databases, files, or preference storage. Chat and knowledge-base files do not have additional application-level end-to-end encryption. The App does not implement its own cloud synchronization service. Device backups, system synchronization, and copies you export are subject to the corresponding system settings and service rules.
• Temporary chats: Temporary chats and their drafts are excluded from regular chat history and persistent storage, global memory, history retrieval, and history summarization. Their content still exists in memory while in use and is transmitted to the relevant service when model or tool requests are made.
• Developer servers: The current version does not use a developer-operated chat relay or central service that collects chat content. The App sends requests directly to the service addresses you configure or use.

2. Data Transmission and Third-Party Processing

• Model requests: Depending on the feature used, the App sends necessary authentication information, system prompts, messages, relevant conversation context, images or extracted attachment text, model parameters, enabled Skill instructions, tool definitions, and tool results to the selected provider or custom proxy. Regular chats may also invoke models in the background to generate titles, image descriptions, or other supporting content. Initial request URLs for remote providers must use HTTPS; HTTP is allowed only for local loopback addresses. A custom proxy can receive and process the data you send to it.
• Memory and chat history: When the relevant features are enabled, the App may send relevant conversations and saved memories to a model after a conversation or during background processing to extract or update memories or generate history summaries. With history retrieval enabled, a model can use local tools to search and read regular past conversations; results are sent to the current chat provider as context. These features can be disabled in Settings. Disabling them does not automatically delete existing local memories or data already sent to third parties. Manually requesting a memory update also invokes a model.
• Knowledge bases: Document reading, text extraction, and OCR take place on your device. During import, rebuilding, or index retries, document chunks are sent to the selected embedding provider. Search queries may also be sent to that provider to generate query vectors. Retrieved excerpts are sent to the current chat provider. The embedding and chat providers may be different.
• MCP and search tools: When remote MCP services, including Tavily search, are enabled, tool names, call arguments, and authentication credentials are sent to the corresponding service, and results may be returned to the chat model. Tool calls request confirmation individually by default. If you disable confirmation, the model can make calls automatically while the tool is enabled. Skill content is sent as model instructions; this does not mean that scripts within a Skill run on your device.
• Speech, photos, and system features: Speech input uses Apple frameworks and requires on-device recognition. It does not fall back to cloud recognition when unavailable. Recognized text is inserted into the composer for you to confirm before sending. Captured photos are used only for chat by default. If saving to the photo library is enabled, the App also saves the original after capture; temporary chats never save captured photos to the photo library. Authorized background completion notifications may contain a conversation title and a reply summary; previews are controlled by system settings. When you deliberately use clipboard shortcuts, export, share, or open external links, the corresponding content is provided to the destination feature, app, or service as part of that action.
• Third-party policies and diagnostics: The App does not integrate third-party advertising, tracking, or analytics SDKs. Models, proxies, tools, and system services used by the features above still process data under their own rules. Consult each service's privacy policy for retention periods, training uses, and deletion procedures. Operating systems, development tools, and service providers may generate diagnostic records. The App does not control third-party providers' data-processing practices.

3. Data Deletion

You can use the corresponding in-app management screens to delete conversations, memories, knowledge bases, provider configurations, API keys, or MCP configurations. Deleting a conversation also deletes its draft. Deleting a knowledge base or file index removes the corresponding extracted text, chunks, and vectors stored by the App, without deleting your original files. Clearing an individual AI response affects the corresponding local content and does not upload chat content or clearing records to the developer.

Uninstalling the App normally removes its container data but is not guaranteed to remove credentials from the Keychain. To delete credentials, first delete the corresponding API key, provider configuration, or MCP configuration in the App and confirm that the operation succeeds. Deleting a key does not automatically delete all chats or knowledge-base content.

Deleting local data does not delete data already sent to third parties. It also does not automatically delete photos in your system photo library, copies you have exported or shared, or independent backups. Manage these copies separately in the corresponding service, app, or system settings. Third-party retention and deletion are governed by the relevant provider's rules.

4. Updates to This Policy

We may update this Privacy Policy from time to time. Changes will be published directly on this page or within the App. Chinese is the original version; English is its corresponding translation.