You control where every conversation lives: synced to encrypted cloud storage, kept only on one device, or used without persisting its history. This page covers the storage modes and how deletion and export work.
Storage modes
Local-only chats
Local-only chat history stays on the device where you created it and never enters cloud storage, even with cloud sync enabled. Messages still go to attested inference enclaves when you chat.
- Go to Settings → Cloud Sync and turn on Enable local chats.
- The sidebar now shows Cloud and Local tabs. Chats created under the Local tab stay in this browser’s local storage and are not uploaded to cloud storage.
- To promote a local chat to the cloud later, drag it to the Cloud tab or use Move to cloud in the chat’s menu.
- Go to Settings → Cloud Sync and turn on Enable local chats in the Local Chats section.
- The sidebar shows a Cloud / Local switcher. Chats created under Local are encrypted with a device key that never leaves the phone.
Local chats are permanently erased when you sign out. Treat local chats as
temporary, or move them to the cloud if you need to keep them.
Temporary chats
Temporary chat history is not persisted to disk or cloud by the chat app. Messages still go to attested inference enclaves, where transient inference and prompt caching can apply.
- Web: click the ghost icon in the top-right of the chat area (Temporary chat). To keep a temporary conversation after all, click Save chat and it becomes a normal chat.
- iOS: tap the ghost icon in the navigation bar on a new chat (Start temporary chat). A Temporary label shows while active; leaving the chat discards it. Sharing creates a persistent encrypted snapshot without saving the chat itself.
Temporary chats never appear in the sidebar and vanish when you exit them. On web, use Save chat before sharing. On iOS, you can share an encrypted snapshot directly.
Exporting your data
From the web app’s Settings → Cloud Sync tab:
- Export Chats downloads a re-importable JSON file, or a ZIP archive when binary attachments are included. The export includes cloud conversations available to your account and local-only chats stored in that browser. Premium is required to export project chats.
- Export Projects is available on Premium plans and downloads your projects — settings, instructions, and documents — in a Claude-compatible format.
On iOS, Settings → Manage Data → Export Chats opens the web app’s export page; exports run from the web app. Since the web app cannot reach chats stored locally on your phone, local-only iOS chats are not included in exports.
How deletion works
Deleting a single chat
Deleting a chat removes it from the device and issues a delete to cloud storage. The deletion propagates to your other devices on their next sync. If you delete while offline, the cloud delete is queued and retried automatically when connectivity returns.
Deleting all chats or projects
- Web: Settings → General → Data → Delete all saved chats (type the confirmation phrase to proceed). Delete all projects is alongside it.
- iOS: Settings → Manage Data → Delete All Chats or Delete All Projects (each with typed confirmation).
Deleting all projects detaches the chats inside them but keeps the chats.
Deleting a project
Deleting a project removes its instructions and documents from cloud storage while keeping its chats outside the project.
Turning off cloud sync
Disabling cloud sync removes the synced chats from the current device but does not delete your cloud data. Re-enabling sync (with your key) restores access. To remove data from Tinfoil’s servers, use the delete actions above.
What deletion means server-side
Deletion removes the encrypted records from server-side storage and syncs the change to your other devices. Tinfoil does not decrypt the content as part of deletion.
Signing out
Signing out clears the app’s local state:
- Local-only chats are permanently erased.
- Cached cloud chats are removed from the device (they remain in encrypted cloud storage).
