Zero-retention by design · No accounts · Open core

Your keys.
Your models.
Nothing stored.

Veil is a private AI workspace for iOS, Android, and web. Bring your own API key from OpenAI, Anthropic, or Google. Configure agents for your workflow. Veil never retains your prompts, responses, files, or keys on any server — ever.

No data collected Your keys stay on-device

How it works

Three steps. No middleman.

Unlike most AI apps, Veil doesn't sit between you and the model with its own backend, billing, and logs. It's a carrier, not a custodian.

01

Bring your key

Paste an API key from OpenAI, Anthropic, Google, or any OpenAI-compatible endpoint. It's validated instantly and stored in your device's secure keystore — never on a server.

02

Pick an agent

Choose from built-in agents for productivity, research, coding, writing, or build your own with custom prompts, tools, and permission controls.

03

Chat privately

Your messages stream directly to the model you chose. Veil routes the bytes, holds nothing. Conversations are ephemeral by default — opt in to local persistence only if you want it.

Zero-retention model

Privacy isn't a setting. It's the architecture.

Most apps promise privacy and then log everything to run analytics and metering. Veil can't retain your data — because there's nowhere to retain it.

Keys never leave your device

API keys live in the iOS Keychain or Android Keystore (hardware-backed when available). They're decrypted in memory only at request time, then dropped. Never in a database, never in logs.

Ephemeral by default

New conversations exist in RAM only and clear when you close the app. Persistence is an explicit per-conversation opt-in, encrypted locally. Nothing is stored unless you choose to store it.

Stateless backend

The relay is a thin Cloudflare Worker. It holds no keys, logs no bodies or headers, and has no durable storage. It can't leak what it doesn't have. We prove this in code, not just in copy.

No accounts, no tracking

No sign-up. No analytics. No advertising SDKs. No third-party scripts. Veil doesn't know who you are, and it has nothing to sell.

Transparent providers

Veil can't force OpenAI or Anthropic to forget — but it shows you each provider's retention policy up front and sends their zero-data-retention flags automatically where supported.

Honest about limits

On web, there's no hardware keystore, so keys are encrypted in-browser instead. We tell you this in the app, not in a 47-page policy you'll never read.

Bring your own key

One app. Every provider.

Already pay for OpenAI or Anthropic? Use them directly. Veil adds a flexible provider layer so the model you pick is the model that answers — no re-billing, no shared keys, no markup.

OpenAI
GPT-4o · o1 · GPT-4o mini
ZDR flag supported
Anthropic
Claude 3.5 Sonnet · Opus · Haiku
ZDR flag supported
Google AI
Gemini 2.0 · 1.5 Pro · Flash
Vertex controls
OpenAI-compatible
Together · Groq · Mistral · OpenRouter · vLLM
Any endpoint
Custom
Your own base URL + headers
Power-user escape hatch

Adding a new provider means writing one adapter — the UI, agents, and streaming pipeline all speak the same provider-agnostic interface.

Custom agents

Assistants tuned for how you work.

Inspired by enterprise assistants, but user-owned and locally defined. Each agent has its own system prompt, model, tools, and permission profile. Build your own or start from a template.

Productivity

Triage tasks, draft replies, plan your day.

webFetch

Research

Multi-query research with citations.

webFetch

Coding

Code review, refactor, explain.

readLocalFile

Writing

Long-form drafting with style control.

prompt-only

Business Ops

Structured extraction from documents.

jsonOutput

Docs

Q&A over a document with citations.

readLocalFile

Automation

JSON-output pipelines for export.

jsonOutput

Tools are typed and permission-scoped

Agents can call allow-listed tools like webFetch, readLocalFile, or jsonOutput. Every tool input is schema-validated, every call respects the agent's permission profile, and calls above a cost threshold trigger an in-app approval sheet. No tool can read your keys — only the runtime can, and only at request time.

FAQ

Questions, answered honestly.

Where is my data stored?

On your device, encrypted — and only if you opt in. Conversations are ephemeral (RAM-only) by default and clear when you close the app. API keys live in the iOS Keychain or Android Keystore, decrypted in memory only when a request is made. Nothing about your conversations is stored on any server Veil operates.

Can Veil see my API key?

No. Keys are stored on your device and sent directly to the provider you chose, in the request, over TLS. On native, the key is handled by the OS keystore and never touches the app's files. On web, it's encrypted with WebCrypto and stored in your browser's IndexedDB — weaker than a hardware keystore, which is why we recommend the native app for sensitive use.

What does "zero-retention" actually mean?

It means Veil's backend (a stateless Cloudflare Worker) holds no keys, logs no request or response bodies, has no database, and no user accounts. It can't leak what it doesn't store. This is enforced in code and auditable — the relay forwards bytes and drops them.

Does the AI provider keep my data?

That depends on the provider's own policy, which Veil cannot override. OpenAI and Anthropic do not train on API traffic by default and expose zero-data-retention options for eligible accounts — Veil sends those flags automatically. Google's Gemini API retention varies by tier. Veil shows you each provider's policy in the app so you can decide.

Is the web version as private as the app?

Almost. The web app shares the same zero-retention backend and ephemeral-by-default conversation model. The difference is key storage: browsers have no hardware keystore, so web keys are encrypted in IndexedDB instead. For maximum security, use the iOS or Android app. We tell you this in the web onboarding, not in fine print.

Why would I use this instead of ChatGPT directly?

Three reasons: (1) you bring your own key and pay the provider directly — no markup, no re-billing, no usage limits set by a middleman; (2) one app works with every provider and your custom endpoints; (3) configurable agents with tools and permissions, on a privacy architecture that doesn't exist in consumer chat products.

What happens if Veil shuts down?

The app keeps working. Your keys are on your device, your conversations are local, and the providers are independent. The only thing that would stop is the optional agent-template catalog served from the relay — and even that, you'd keep the agents you already installed.