How Private Is SillyTavern? Local Models vs. Private APIs

SillyTavern stores your conversations, characters, and settings locally by default. But that does not automatically make every conversation private. If you connect SillyTavern to a cloud AI model, the information needed to generate a response leaves your device and reaches the configured API provider.

That distinction matters if you use SillyTavern for personal conversations, character roleplay, or discussions you would prefer not to share with third parties.

Fortunately, you have several options. You can run a language model locally, choose a cloud provider with limited data retention, or use infrastructure that offers additional technical privacy protections.

This guide explains what actually stays private in SillyTavern, how local and cloud AI backends compare, which privacy claims deserve closer inspection, and how to connect a private API in 2026.

Bottom line: A securely configured local model offers the most direct control over SillyTavern conversations. If cloud inference is necessary, choose a provider with documented retention practices and verify the privacy controls available for your selected model route.

What Does Privacy Actually Mean in SillyTavern?

Privacy is not a single setting. Different users have different expectations when they say they want a private AI conversation.

Some want to prevent their chats from being used for model training. Others want conversations deleted after processing, or they want to avoid linking their activity to a personal identity.

These are separate requirements. A provider may satisfy one without satisfying the others.

One particularly important distinction is the difference between processing and storing a conversation.

A cloud provider may process your prompt in memory and discard it immediately afterward. That can reduce retention risks, but the provider still receives the content during inference.

Similarly, using an AI service without registering an email address may reduce the information associated with your account. It does not necessarily make you anonymous. Network information, payment records, session identifiers, and details included in prompts may still reveal your identity.

How SillyTavern Handles Your Chat Data

SillyTavern is an AI chat front end. It connects to language model backends rather than running a large language model by itself.

In a standard installation, it stores user information such as character files, chat histories, settings, and API credentials in its local data directory.

However, local storage and cloud inference are different operations.

• Local model: SillyTavern sends requests to a model server running on your computer or another machine you control.
• Direct cloud API: SillyTavern sends requests to the selected AI service.
• API aggregator: SillyTavern sends requests to a gateway, which may forward them to an upstream inference provider.

The request can contain more than your latest message. Depending on your configuration, it may include character descriptions, persona information, system instructions, lorebook entries, conversation history, and other contextual data.

This means that keeping saved chat histories locally does not prevent relevant conversation content from being transmitted to a cloud model.

Local Chat Storage Is Not Automatically Encrypted

There is another privacy consideration that users should not overlook.

According to SillyTavern’s multi-user documentation, user data, including chat histories, API keys, and other sensitive information, is stored in plaintext on the server.

Anyone with sufficient filesystem access may be able to inspect or modify that information.

This is especially important if you install SillyTavern on a shared computer or a remotely accessible server.

To reduce these risks:

• Restrict access to the machine and SillyTavern data directory.
• Use full-disk encryption where appropriate.
• Keep your operating system and SillyTavern installation updated.
• Avoid running SillyTavern on untrusted shared infrastructure.
• Protect API credentials and review backups that may contain conversation histories.
• Do not expose the application or local model server directly to the public internet without appropriate security controls.

Important: Local inference gives you greater control over where information is processed. It does not automatically protect saved data from someone who gains access to your device or server.

Running a Local AI Model for Maximum Privacy

Running a language model yourself offers the most straightforward way to keep inference requests on hardware you control.

Once the required software and model files are downloaded, many local models can operate without an active internet connection.

Three popular options are KoboldCpp, LM Studio, and Ollama.

KoboldCpp

KoboldCpp is a local inference backend commonly used with GGUF language models.

It is particularly relevant to SillyTavern users who want control over generation settings and access to models commonly used for creative writing and roleplay.

KoboldCpp supports CPU inference and different hardware acceleration options, depending on the operating system and available hardware.

LM Studio

LM Studio provides a graphical interface for downloading, loading, and running compatible language models.

It also includes a local server with OpenAI-compatible endpoints, making it suitable for connecting desktop applications and AI front ends.

Its commonly used local API base URL is:

http://localhost:1234/v1

According to the official LM Studio offline documentation, downloaded models can run locally without an internet connection.

Some operations, such as discovering new models, downloading model files, and retrieving updates, still require connectivity.

Ollama

Ollama is another option for running language models locally.

It provides a command-line workflow for downloading and managing models, along with a local API that compatible applications can use.

Its default local server address is:

http://localhost:11434

Ollama can be convenient if you prefer working from the terminal or want to use the same local model backend across multiple applications.

How Much Hardware Do Local Models Need?

Hardware requirements depend on several factors:

• Model parameter count and architecture.
• Quantization, which reduces the memory needed to store model weights.
• Context length and memory used for ongoing conversations.
• Available system RAM and GPU memory.
• The inference backend and acceleration method.

For example, a quantized 7B or 8B parameter model may run on a computer with relatively modest memory. Larger models, higher precision, and longer context windows generally require more resources.

There is no universal memory requirement or generation speed for all models of the same size.

A compatible GPU can improve performance, but CPU inference is possible for many models, usually at a slower speed.

Local inference also introduces maintenance responsibilities. You need to manage model downloads, storage, software updates, performance, and security.

For a fully offline setup, review extensions, remote tools, cloud backups, and any features that may communicate with external services.

What Makes a Cloud AI API Private?

Cloud APIs give SillyTavern users access to models without requiring powerful local hardware.

But selecting a private cloud API involves more than finding a provider that promises not to log conversations.

Four areas deserve attention.

1. Prompt and Response Retention

Check whether the provider stores prompts, outputs, or conversation histories after processing.

Some services keep only operational metadata, while others offer optional debugging logs or temporary retention for safety and abuse prevention.

Look for explicit retention terms rather than broad marketing statements.

2. Training and Secondary Data Use

Verify whether prompts and responses may be used to train models, evaluate outputs, improve services, or serve other purposes.

A no-logging policy and a no-training policy are not necessarily the same thing.

3. Upstream Model Providers

API aggregators often connect users to models operated by separate inference providers.

Even if the aggregator does not retain prompt content, the upstream provider must process the request to generate a response.

Its policies and security controls also affect the privacy of your conversation.

4. Technical Privacy Verification

Some cloud services use trusted execution environments, also called TEEs.

A TEE is a protected processing environment designed to isolate certain code and data from other parts of the hosting infrastructure.

Hardware attestation can provide evidence that a particular workload is running within an expected environment.

However, attestation alone does not prove that prompts are never retained. It also does not establish the behavior of every external provider involved in processing a request.

Stronger confidential-inference implementations may use client-to-enclave encryption, where the request is encrypted before the ordinary gateway infrastructure can read it.

The protection depends on the verified software, encryption path, and the boundaries of the attested environment.

Private API Providers Worth Comparing

Several AI API providers offer privacy-related features that may be relevant to SillyTavern users.

Their approaches differ. Some emphasize limiting prompt retention, while others provide confidential-computing infrastructure or controls over upstream model selection.

These descriptions are based on published provider documentation. They should not be treated as the results of an independent security audit.

AnonRouter

AnonRouter focuses on privacy-oriented request routing and confidential-computing infrastructure.

According to its privacy documentation, its dedicated private flow separates account identity from request content through a ticket-based architecture.

The service also describes Intel TDX confidential virtual machines and mechanisms for verifying the protected processing environment.

However, ordinary OpenAI-compatible access operates differently from the private ticket flow.

In compatibility mode, a broker temporarily handles authentication information and request content together. That means it does not offer the same unlinkability guarantees as the dedicated ticket-based process.

Users should confirm which mode their client actually supports.

TrustedRouter

TrustedRouter publishes information about its confidential-computing infrastructure and offers verification mechanisms for its gateway.

Its trust documentation explains how users can check attestation evidence and compare the running workload with published release information.

These mechanisms provide a way to evaluate whether the gateway is operating within its documented protected environment.

However, gateway attestation should not be confused with verification of every model provider that may receive a request.

Users should assess the entire route, particularly when requests are forwarded to external inference services.

OpenRouter

OpenRouter provides access to multiple AI model providers through a common API.

It offers privacy settings that can help users restrict model providers based on their published training and retention practices.

Its documentation also describes zero-data-retention routing, which restricts eligible requests to providers that do not routinely store prompt or response content after processing.

However, not every provider follows the same policy.

OpenRouter distinguishes between zero retention and safety retention. Under safety-retention policies, providers may retain request content for abuse-prevention purposes rather than model training.

Users who need strict retention controls should review the chosen model’s routing policy and the relevant OpenRouter provider logging documentation.

Third-party tools connected through the API may also introduce separate data-processing requirements.

Where NanoGPT Fits Into the Privacy Comparison

NanoGPT provides access to cloud-hosted language models through a single API, including models used for creative writing and roleplay.

Its privacy approach includes limited default prompt retention, configurable logging, provider-specific routing, and additional privacy features for supported model routes.

It is important to distinguish these features rather than treating them as one universal guarantee.

Prompt Logging and Retention

According to NanoGPT’s published privacy documentation, the platform does not routinely retain prompt and response content as part of normal inference by default.

It does retain limited non-content metadata for purposes such as billing, service reliability, and abuse prevention.

API-key owners can optionally enable encrypted request and response logging. This feature is disabled by default.

The documented log retention window can be configured between one and 30 days.

These statements describe NanoGPT’s published practices. They are not independent verification of every internal processing operation.

Account Identity and Conversation Storage

NanoGPT allows users to access parts of its service without providing an email address.

In its own web interface, conversation history is stored in the browser by default. Optional synchronization and sharing features may result in additional cloud storage.

When NanoGPT is connected through SillyTavern, SillyTavern manages its own saved conversation history.

However, the conversation context included in each inference request is still transmitted through the selected NanoGPT model route.

Using a service without an email address reduces certain identifying information, but it does not eliminate all possible links between a session and a user.

TEE Attestation and Private Mode

NanoGPT supports TEE-backed inference routes and additional confidential-processing features for certain configurations.

Its documentation makes an important distinction between ordinary TEE routing and Private Mode.

On a standard TEE route, NanoGPT may receive the request in plaintext before forwarding it to the protected inference environment.

With supported Private Mode configurations, the client can verify the protected destination and encrypt the request before NanoGPT’s ordinary gateway infrastructure receives it.

That provides a different level of protection, but the exact guarantees still depend on the verified implementation.

Important: Connecting SillyTavern through an ordinary OpenAI-compatible API does not automatically enable NanoGPT’s browser-based Private Mode or client-to-enclave encryption.

Users requiring that level of protection must verify that their chosen client and model route support the necessary encryption and attestation process.

Upstream Provider Limitations

NanoGPT does not operate every model on its own infrastructure.

It uses external inference providers for many requests. Those providers receive the content necessary to generate a response.

NanoGPT’s zero-data-retention routing relies on commitments made by participating model providers. Its documentation acknowledges that it cannot independently inspect every provider’s internal servers.

As a result, the service’s default no-content-retention policy should not be interpreted as proof that every available model has identical privacy guarantees.

How Much Does a Private SillyTavern API Cost?

Cloud AI APIs commonly charge according to input and output token usage.

Input tokens include the prompt and relevant conversation context sent to the model. Output tokens represent the response the model generates.

For comparison, here are two examples from NanoGPT’s published pricing, checked on November 7, 2026.

Suppose a SillyTavern request contains 2,000 input tokens and produces 500 output tokens.

At the listed rates, the estimated cost would be approximately:

• GLM 5.3 Flash Uncensored: $0.0008 per request.
• Claude Sonnet 5.5: $0.009 per request.

These examples use the published standard input and output rates. Actual charges may differ with context tiers, caching, provider routing, or other applicable features.

Roleplay conversations can become increasingly expensive because the model may receive character information, system instructions, lorebook entries, and previous conversation messages with each request.

As a conversation grows, input-token usage can increase even when the latest user message is short.

For current prices and supported models, check the NanoGPT pricing page.

One final distinction: a model described as uncensored or less restricted is not necessarily more private. Content restrictions, model behavior, and data retention are separate considerations.

How to Connect a Private API to SillyTavern

SillyTavern supports multiple model backends, including locally hosted inference servers and OpenAI-compatible cloud APIs.

The exact settings depend on the selected provider and the version of SillyTavern you are using.

Step 1: Open API Connections

Launch SillyTavern and click the plug icon in the top navigation to open the API Connections panel.

Step 2: Choose Your Connection Type

For a supported cloud provider, select Chat Completion and choose the provider from the Chat Completion Source list.

If your provider is not listed, select Custom (OpenAI-compatible), provided it supports the required API format.

For local models, use the backend’s supported SillyTavern integration when available.

Step 3: Enter the Endpoint and Credentials

For a custom OpenAI-compatible connection, enter the API base URL, authentication key if required, and selected model identifier.

Two examples are:

These URLs follow the providers’ documented default configurations. A customized local server may use a different port or address.

Do not append /chat/completions when SillyTavern asks for an OpenAI-compatible base URL. SillyTavern normally constructs the full request endpoint.

Step 4: Connect NanoGPT to SillyTavern

Recent SillyTavern versions include NanoGPT as a Chat Completion Source.

To connect:

1. Open SillyTavern’s API Connections panel.
2. Set the API type to Chat Completion.
3. Select NanoGPT from the Chat Completion Source list.
4. Enter your NanoGPT API key.
5. Click Connect and choose an available model.
6. Send a short test message to confirm the connection works.

If NanoGPT does not appear in the source list, update SillyTavern or use Custom (OpenAI-compatible) with the documented NanoGPT API base URL.

For detailed setup instructions, see NanoGPT’s API documentation.

Step 5: Troubleshoot Connection Problems

If SillyTavern cannot connect, check the following:

• Authentication error: Confirm that the API key is active and correctly entered.
• Model not found: Copy the exact model identifier from the provider’s current catalog.
• Incorrect endpoint: Verify the API base URL and whether it should end with /v1.
• Insufficient balance: Check your available credits, subscription eligibility, and API spending limits.
• Compatibility issue: Confirm that the model supports the request format and features your SillyTavern configuration uses.

SillyTavern’s official Chat Completions documentation provides additional instructions for custom endpoints and connection testing.

Never publish your API key in screenshots, support messages, shared configuration files, or character cards.

Privacy Checklist Before Using SillyTavern

Before sending sensitive information through SillyTavern, review the complete setup rather than relying on a single privacy feature.

1. Identify the model backend. Confirm whether inference runs locally, through a direct cloud API, or through an aggregator.
2. Review prompt retention. Check whether the provider stores prompts, outputs, or conversation histories, and for how long.
3. Check training policies. Verify whether user content can be used for model training or other secondary purposes.
4. Inspect upstream routing. Determine which inference provider receives the request and whether its privacy policy meets your requirements.
5. Disable unnecessary logging. Review optional request logs, debugging features, and enabled tools that may store conversation content.
6. Protect local files. Restrict filesystem access, enable disk encryption where suitable, and protect backups containing chats or credentials.
7. Review extensions. Search tools, image generators, remote services, and other integrations may transmit information beyond the model backend.
8. Verify confidential-computing claims. If a provider offers attestation, check what software is verified and whether the actual client uses the protected route.
9. Avoid unnecessary sensitive data. Do not include passwords, recovery codes, financial credentials, or identifying information unless there is a clear need and suitable protection.
10. Keep your software updated. Apply security updates to SillyTavern, the local inference server, extensions, and operating system.

For additional practical security advice, read the guide on securing your local development environment.

No single setting eliminates every privacy risk. The right configuration depends on the information you want to protect and the services you are willing to trust.

Final Verdict: Which SillyTavern Setup Should You Choose?

If privacy is your highest priority and your hardware can handle the models you need, running SillyTavern with a local inference backend is the most straightforward choice.

Local models give you direct control over where inference takes place. However, you must still protect saved conversations, API credentials, local servers, and enabled extensions.

If local inference is not practical, choose a cloud API with clearly documented retention rules, transparent provider routing, and privacy controls that match your requirements.

OpenRouter, NanoGPT, AnonRouter, and TrustedRouter offer different approaches worth evaluating. None should be considered universally private across every model, client, and request route.

NanoGPT may suit users who want access to multiple cloud models through one API with configurable privacy features. Providers offering attested confidential-computing infrastructure may be worth evaluating when technical verification is a specific requirement.

Ultimately, SillyTavern privacy is not determined by the name of the front end or the language model alone. It depends on where your requests travel, who can process them, what information is retained, and which safeguards you can verify.