Privacy and data locations
Local GGUF inference runs on your PC. Connected providers, web tools and code can send data over the network; the sections below explain what is stored and what can leave your machine.
What stays on your PC
When you chat with a local GGUF model, the bundled llama.cpp server processes your messages on your own hardware. Conversations, models, logs, Projects, Skills, notes, workspaces and generated files stay on your PC unless you send them through a connected provider or an agent-run tool, or copy them elsewhere. Native read tools can inspect files outside the workspace; code and scripts run with your Windows account's permissions.
You do not need an account for local chat. ChatGPT sign-in and other provider connections are optional. LlamaBoss has no built-in telemetry; connected services have their own data handling policies.
Features that use the network
| Feature | What happens |
|---|---|
| Model download | Downloads the model files you chose from where they're hosted. |
| Update check and installation | Check for Updates fetches https://llamaboss.com/version.json. Download and Install also downloads the installer after you choose it. |
| AI providers | Sends your request to the provider whose model you selected. |
| Web page fetch | Downloads the specific page the agent fetches. |
| Python package install | Runs pip after you approve that exact package. |
| PowerShell, Python and scripts | Code can use your account’s network permissions. Arbitrary code and script runs ask for approval by default. From 0.1.23, a script receives only the service keys its own SKILL.md or WORKFLOW.md declares, and AI provider keys never reach a script unless its SKILL.md names that provider. In 0.1.21, every saved key is passed to every script run. |
Optional ChatGPT connection
Signing in opens ChatGPT in your browser and authorizes the connection. When its model is selected, requests can include conversation content, Project and Skill context, attachments, and tool results, just as with other remote providers. Signing out removes the saved local authorization and attempts to revoke it. Sign-in tokens and exported transcripts should not be shared.
Where things are stored
| Data | Location |
|---|---|
| Models | %LOCALAPPDATA%\LlamaBoss\models, or your own models folder |
| Conversations | %LOCALAPPDATA%\LlamaBoss\conversations |
| Logs | %LOCALAPPDATA%\LlamaBoss\logs |
| Settings and cache | %LOCALAPPDATA%\LlamaBoss\config and cache |
| Image thumbnails | %LOCALAPPDATA%\LlamaBoss\thumbcache |
| AI providers | %LOCALAPPDATA%\LlamaBoss\endpoints.json |
| Saved keys | %LOCALAPPDATA%\LlamaBoss\secrets.json (Windows DPAPI encrypted) |
| ChatGPT sign-in tokens | %LOCALAPPDATA%\LlamaBoss\chatgpt_accounts.json (Windows DPAPI protected) |
| Chat workspaces and stored variables | %USERPROFILE%\LlamaBoss\Chats (legacy chats may remain in Workflows) |
| Shared scripts and benchmark results | %USERPROFILE%\LlamaBoss\Shared\Scripts and Shared\Benchmarks |
| Projects | %USERPROFILE%\LlamaBoss\Projects |
| Skills | %USERPROFILE%\LlamaBoss\Skills |
| Notes (from 0.1.23) | %USERPROFILE%\LlamaBoss\Notes |
| Personal notes (0.1.21) | %USERPROFILE%\LlamaBoss\NOTES.md |
| Reminders | %USERPROFILE%\LlamaBoss\REMINDERS.json |
Saved keys
Windows 0.1.21 encrypts saved API and service keys in secrets.json with DPAPI for the current Windows user. ChatGPT sign-in tokens use DPAPI protection in chatgpt_accounts.json. Copying these files to another user or machine does not transfer a usable sign-in. Choosing the environment-variable option keeps the actual key out of secrets.json. Encryption at rest does not prevent code running as your Windows user from accessing credentials.
When an older plaintext key file is loaded, LlamaBoss attempts to save it in encrypted form. If that migration fails, the old file can remain plaintext and a warning is logged. Newly saved credentials do not fall back to plaintext when encryption fails.
Don't share or attach secrets.json. Before sharing source archives or logs, check that no scripts or config files contain copied keys.
Uninstall and cleanup
Uninstall LlamaBoss from Windows Settings → Apps. Models and your own files are left in place so an uninstall never deletes them by surprise. To remove everything, review and delete:
%LOCALAPPDATA%\LlamaBoss
%USERPROFILE%\LlamaBossOnly delete a custom models folder if no other app uses it.