Some of it should never leave the phone.
A journal about your own head is not the same as a search query, and it is not treated the same way. Here is exactly what is kept, where, and what is not.
Lock the whole app
A four-digit PIN, a longer passcode, a pattern, or your fingerprint and face through the device's own authenticator. Nothing is stored in readable form — only a salted SHA-256 hash the app can check a guess against.
It locks itself
Choose how long it waits — immediately, or after a few minutes away. Come back later and the lock screen is there before anything else renders.
Incognito
The interface turns grey and the app stops writing anything down. No history entry, no summary, nothing synced. Close the chat and it is gone.
Mood stays local
Check-ins are written to the device and never uploaded. The chart is for you; there is no copy of it on any server.
The key is not in the page
The model key lives in a server environment and is used by an endpoint the app calls. It is never included in the JavaScript sent to your browser, so it cannot be read out of the page.
Your own key, if you prefer
Paste your own Gemini key in Settings and the app talks to Google directly from your browser on your quota, without going through the server at all.
What is stored, plainly
Signing in with Google creates an account record and your conversations are saved to it, so history follows you between devices. Incognito threads are excluded. Mood check-ins and reasoning-test results are kept on the device only. Deleting a conversation removes it from the account.
What this is not
Conversations go to a model to be answered, which means they leave the device like any other AI app. The app lock protects the phone in your hand, not the request in flight. If something must never be sent anywhere, do not type it into an AI app — this one included.
Set the lock in under a minute.
Settings, then App lock — PIN, pattern or biometrics.