Where your data lives.
Portico has no server, so there is nowhere for your conversations to go. This page says where they are instead, what is encrypted, and the handful of things that do leave the machine.
Applies to version 0.23.0 · last changed 17 August 2026
Every file Portico writes
All of it sits in one folder, which you can open, copy, back up or delete without the app running.
| Where | What | Encrypted |
|---|---|---|
chats/ |
One file per conversation, including anything you attached | Yes |
projects.json |
Project names and standing instructions | Yes |
assistants.json |
Saved personas and their generation settings | Yes |
settings.json |
Your preferences. The three API keys inside it are sealed individually; the rest stays readable so the app can start without a keyring | Keys only |
models/ |
The model files you downloaded. Several gigabytes each | No — they are public weights |
artifacts/ |
HTML the model produced, when you open a preview | No |
images/ |
Pictures you generated. The file names are timestamps — what you asked for stays in the conversation, which is encrypted | No |
plots/ |
Figures drawn by Python code you ran in a chat | No |
sd-engine/ |
The image engine, downloaded the first time you ask for a picture | No — it is a program, not your data |
portico.log |
Start-ups, errors and engine crashes. No prompts, no replies. Rotates
to portico.previous.log at 2 MB |
No |
%APPDATA%\Portico\~/Library/Application Support/Portico/~/.config/Portico/What the encryption does and does not do
Conversations, projects, assistants and API keys are sealed with the operating system’s own keyring: DPAPI on Windows, the Keychain on macOS, libsecret or kwallet on Linux. There is no passphrase, so there is none to forget.
The key belongs to your user account. That is the whole boundary, and it is worth being exact about which side of it you are on.
Three kinds of file sit outside it, and the table above says which: pictures you generated, figures your Python drew, and HTML previews. They stay plain because they have to be opened as files to be shown at all. Their names give nothing away — a picture is named after the moment it was made, not after what you asked for — and the prompt behind it lives in the conversation, which is sealed.
- Protects a stolen or lost laptop, a disk pulled from the machine, a backup, a synced folder, and another user account on the same computer.
- Does not protect against anyone already signed in as you, or software running with your permissions.
This is the same line a password manager draws. Where no keyring exists — a Linux install without libsecret — Portico writes plain files and says so on the Settings screen rather than failing quietly either way.
Everything that leaves this computer
The complete list, in the order you are likely to meet it. Chatting with a local model appears first because it makes no request at all.
-
Chatting — nothing
Your message goes to
llama-server, a process on this machine listening on127.0.0.1, and the reply comes back. Nothing is sent, and the app works with the network unplugged. -
Web search — your message, to a search engine
Off until you switch it on, and labelled on screen while it is. Your message is tidied of filler and sent as the query — it is not reduced to keywords, so assume the search provider sees roughly what you wrote. Portico requests the result pages from the main process, not from a browser, and refuses any result pointing at a local or private address.
-
Downloading a model — your address, to Hugging Face
An ordinary file download. They see an IP address and which file you asked for.
What comes back is checked. Portico ships a SHA-256 for every model in its catalogue, taken from the repository that publishes it, and compares the file against that as it arrives. A file that does not match is deleted rather than kept — because a model is a program you are about to run, and several gigabytes arriving over the network is not something to take on trust.
-
The update check — your address and version, to GitHub
One request, eight seconds after launch, asking whether a newer release exists. It sends nothing about you beyond what any HTTP request reveals. Settings → Privacy turns it off.
-
Using someone else’s engine — everything you type
Only if you deliberately point Portico at another machine or a hosted provider. Your prompts are processed on their computer; your chats are still saved on yours. An access key is required, and the host is told what they are taking on.
There is no analytics, and no way to add it quietly
No accounts, no telemetry, no crash reporting, no cookies, no identifiers. Portico never learns which models you use, how often you open it, or what you ask. Not because of a policy — because the code that would do it does not exist.
You do not have to believe that. The source is public and the network calls above are the only ones in it.
If Portico ever started collecting something, it would appear in a commit. That is a weaker promise than a legal one in some ways and a much stronger one in others: a policy can be rewritten between releases, and a diff cannot be hidden.
Read the source →Removing everything
Uninstalling leaves the folder above in place, on purpose — people reinstall and expect their chats back. To remove it all, delete that folder. Nothing is stored anywhere else, and nothing needs to be revoked, because nothing was ever granted.
Try it on your own machine.
Free and open source. Works with the open models you already trust.