Private Mode is a distinct transport and assurance level. A provider-side TEE route is not automatically a client-to-enclave private route.
The public status endpoints expose an assurance object. A configured server reports not_checked until the browser or local proxy performs attestation. Only fresh verified evidence is eligible. Other states include unavailable, stale, measurement_mismatch, verification_failed, and unsupported.
Evidence is fresh for five minutes. Stale evidence triggers re-attestation; failed, malformed, or mismatched evidence fails closed. There is no automatic plaintext fallback to a standard or ordinary TEE route.
Completed browser requests include a version 2 receipt with the model and enclave identity, expected and observed measurements, release digest, HPKE key fingerprint, freshness timestamps, an opaque request-ID hash, and verifier step statuses. Receipts exclude prompts, completions, API keys, and signed URLs.
Copy or download a receipt from the message shield, then independently re-fetch and compare current attestation evidence with:
npx --yes @nanogpt/private-mode@latest verify receipt.json
Receipts are browser-generated and unsigned. They do not prove response authenticity, usage correctness, prompt non-retention, or provider retention behavior. The request-ID hash is for opaque correlation, not proof of server issuance.
NanoGPT cannot read your queries or results. Tinfoil runs search inside its verified enclave, but Exa receives the generated queries and Cloudflare processes fetched URLs and page contents outside that enclave. Search is not end-to-end confidential from those services.
PII and prompt-injection checks are enabled. They reduce risk but cannot guarantee that sensitive information stays out of a query. Avoid searching with secrets or personal details.
Search starts off. Enable it from the search menu for the current open chat; it resets when you leave that chat, reload, or turn off Private Mode. The model decides whether to search. There is no automatic fallback to NanoGPT's ordinary search providers. Opening a cited link contacts that site directly from your browser.
Messages that actually use search cost $0.0525 extra, including the 5% Private Mode fee, plus model tokens. Multiple searches or page fetches in the same request do not multiply that fee. Applicable discounts may reduce it. NanoGPT sees search-call counts and costs in provider-reported billing metadata, not query or result text.
Tinfoil describes Exa's zero-data-retention agreement as a contractual protection, not encryption from Exa. It does not extend enclave attestation to Exa or Cloudflare. See Tinfoil's search documentation and threat model.
Search answers may arrive all at once. When Tinfoil omits the individual inference-enclave header, NanoGPT holds the encrypted response until Tinfoil's reported model identity can be checked. The receipt labels this as a usage-metadata check, not independent model attestation. Browser-to-router encryption and attestation remain required.
Conversation history stays local by default. Private Mode messages are blocked from ordinary cloud sync; passphrase or passkey end-to-end sync is required. Provider-reported Tinfoil usage remains trusted for billing and is not currently end-to-end signed. NanoGPT does not implement attestation-gated KMS release of upstream provider credentials.
See the broader privacy explainer and privacy controls guide for storage, identity, payment, and provider-specific boundaries.