Data, API Keys, and Prompt Transparency

Cumbersome connects your device directly to the AI providers you choose. Folding Sky has no server between the app and those providers, and we never receive your API keys, prompts, or AI responses.

We understand why entering an API key or another authentication value into a third-party app can feel risky. This page explains how Cumbersome handles credentials, stores your conversations, and adds context or tools to AI requests.

API key safety

We recommend creating a separate API key for Cumbersome at each provider. A dedicated key is easier to monitor, limit, rotate, or revoke without disrupting anything else you use.

• Never share an API key with another person.
• Never paste a key into a chat, support message, screenshot, or public document.
• Set spending limits, usage alerts, or rate limits in the provider's dashboard when available.
• Monitor provider usage and billing for activity you don't recognize.
• Revoke and replace a key immediately if you think it has been exposed.
• Remove keys for providers you no longer use.

Your provider controls the key and bills its usage. Review that provider's security, privacy, logging, and retention policies before sending sensitive information.

How Cumbersome stores and uses API keys

Cumbersome stores API keys and other saved authentication values in Apple's device Keychain. If you have iCloud Keychain enabled, Apple can sync them across your devices with end-to-end encryption. This protection doesn't require Advanced Data Protection. Folding Sky can't access your Keychain or iCloud account.

When you make a request, Cumbersome reads the selected provider's key and uses it to authenticate a direct connection from your device to that provider. The request doesn't pass through a Folding Sky server.

Cumbersome sends the information needed to complete your request. Depending on what you use, that can include your message, relevant conversation history, configured system instructions, model settings, attachments, tool definitions, and earlier tool calls or results. The selected provider processes that information under its own terms and policies.

Deleting a provider's key from Cumbersome prevents new requests to that provider. You can also revoke the key in the provider's dashboard.

Multiple custom authentication headers: A custom provider can combine its primary authentication method with extra headers required by a gateway or API. Cumbersome stores every secret value separately in Keychain. Header names can sync with the rest of the provider configuration. Secret values sync only through iCloud Keychain when you enable it. The app sends those credentials only to the provider's configured model-list and inference endpoints. If you change a saved provider to a new destination, Cumbersome requires you to enter its saved credentials again.

Conversation storage and iCloud encryption

Cumbersome stores conversations on your device and syncs them through your private iCloud account when iCloud is available. Folding Sky can't access that data.

Starting with Cumbersome 1.58, released July 18, 2026, newly created records store many sensitive values in CloudKit encrypted fields. Later features use the same protection for their sensitive fields. When you enable Advanced Data Protection for iCloud, those fields are end-to-end encrypted. Cumbersome can't determine whether Advanced Data Protection is enabled on your account.

The protected fields used for new records include:

• Message text, reasoning, pre-edit originals, and raw provider responses.
• Conversation titles and per-conversation system prompts.
• Face/Off and Mind/Meld candidate and judgment data.
• Local-tool arguments, content-bearing diagnostics, and human-readable error details.
• Project names, preset names and previews, attachment filenames, and annotation contents.

Large message content, attachment files, and complete preset bodies can be stored in iCloud Drive. Those files are also end-to-end encrypted when Advanced Data Protection is enabled.

This rollout is forward-only. Cumbersome doesn't rewrite records created before version 1.58, so older data remains under Apple's standard CloudKit protection. New messages use encrypted fields even inside an older conversation, which means one conversation can contain both storage types. Structural sync data, including IDs, dates, relationships, provider and model identifiers, token counts, and timing data, remains in ordinary CloudKit fields.

Settings synchronized through Apple's key-value store are outside this CloudKit encrypted-field claim. This includes custom-provider configurations, custom API parameters, and most preferences. A global system message can use either the key-value store or iCloud Drive depending on its size.

System prompts and current-date context

Cumbersome doesn't add a hidden persona or general behavioral system prompt. The instructions come from what you configure globally, through a project or preset, or for the conversation.

By default, the Include Current Date setting appends this one line to supported AI requests:

The user's current local date is YYYY-MM-DD.

The app creates the date on your device at request time. It doesn't include your time, time zone identifier, language, locale, or location, and it isn't saved as part of your system message. The date applies to regular chats, Ghost/Write, Quick Prompt, and app shortcuts. You can turn it off under Settings > AI > Instructions.

Tools and external services

When a tool is available and enabled, Cumbersome can send its name, description, and input schema to the selected AI provider. The model decides whether to call it unless you explicitly request a feature. Tool definitions consume input tokens even when the model doesn't call them. When Cumbersome executes a local or MCP tool, its call and result are shown in the conversation, and the result can be sent back to the provider so it can continue the response.

Tool availability, settings, and initial defaults can vary by operating system and app version and may change over time. Review the current options under Settings > Tools.

• Local Web Search and Local Web Browser: On iOS 26, iPadOS 26, and macOS 26 or later, Local Web Search sends an AI-generated query from your device to a selected search engine and returns result links and snippets. Local Web Browser loads one page through your device, can run AI-generated JavaScript once, extracts readable content, and then discards that page. These tools can run without displaying a browser window. Each call uses a fresh page and doesn't keep an open page or navigation sequence for the next call. WebKit may still retain ordinary website data, such as cookies or cached resources, outside that page's lifetime. Stateless browsing doesn't mean anonymous or private browsing.
• Web Agent (beta): This visible browser stays with the active chat for multi-step navigation, page inspection, JavaScript execution, and sites you choose to sign into. You can interact with the page at any time. If a site presents a CAPTCHA during access you are authorized to make, you can complete the challenge yourself and then let the AI continue from that state. Web Agent doesn't solve, bypass, or automate the challenge. It uses a nonpersistent browser data store and closes when you close it, disable the feature, or leave the chat. Its tool instructions tell the AI not to inspect password, payment, passkey, or authentication fields. This is an instruction to the model, not a technical guarantee that sensitive information cannot be read or transmitted.
• Question Cards: The model can call this tool once per user turn when it needs clarification. It supplies up to three questions and chooses a control for each one: choices, ranking, slider, date, or confirmation. Cumbersome returns your answers to the provider as the tool result. If you skip the cards, the result tells the model to continue with reasonable assumptions. The tool instructions say not to request secrets or use the cards to confirm an external action. Review every question anyway, and never enter a credential or other secret.
• Local Data Analysis: This is enabled by default when available and is offered only when a supported data attachment is present. The provider receives a tool definition and a manifest containing attachment handles, filenames, media types, and sizes. Python runs on your device with no network access. The resulting text, tables, charts, or errors are returned to the provider and added to the conversation.
• MCP servers: For servers you configure and enable, Cumbersome sends their tool definitions to the provider. A tool call sends its arguments to the remote MCP server. Those arguments can contain information from your prompts, conversations, or attachments. The server's response is added to the conversation and returned to the provider. Review each server's privacy and retention practices before enabling its tools.
• Provider-hosted tools: Depending on your provider and settings, Cumbersome can attach native web-search or image-generation tools. The selected AI provider, not your device, executes those tools under its own terms and policies.

Search engines, websites, and MCP servers receive direct requests from your device when their tools run. Folding Sky doesn't proxy those requests.

Browser tool data flow and untrusted pages

Websites can receive information normally included in a browser request, such as your IP address, browser request data, cookies or temporary session state, search terms, URLs, and content submitted to the page. The selected AI provider can receive extracted page text or HTML, interactive-element details, metadata, and JavaScript results when those outputs are returned as tool results.

The selected model generates browser tool arguments. It can create a search, URL, JavaScript action, page interaction, or navigation using information already present in your prompt or conversation. If Web Agent is signed into a site, inspection or JavaScript can also access information available within that browser session. In unusual or unintended cases, a model-generated action could include conversation or page information in a request to another website or service.

Webpage content is untrusted. A page can contain visible or hidden instructions intended to change the model's behavior, sometimes called indirect prompt injection. Such content could influence later tool calls, redirect the browser, or encourage disclosure to another site. Cumbersome's tool instructions and the selected provider's safeguards reduce this risk but cannot eliminate it. The app does not have a deterministic data-loss prevention system that can prove every AI-generated URL, script, or page interaction is safe.

Web Agent uses a nonpersistent WebKit data store, so its cookies, cache, and other browser state stay in memory rather than being written to the persistent browser store. That state is destroyed when you close Web Agent, disable it, or leave the chat. This limits persistence after the session. It does not prevent a website or the selected AI provider from receiving information while the browser session is open, and it cannot retract information already sent.

You can see and interact with Web Agent at any time. Review the current domain and browser actions, enter credentials yourself, avoid highly sensitive accounts or pages, and close the browser session when you are done. Do not expose information you would not want the selected AI provider or the visited website to process.

Authorized and responsible use

Cumbersome's browser, code, data, and remote tools can take actions with real effects. Use them only with websites, accounts, systems, and data you own or are authorized to access. Security testing requires prior express authorization from someone authorized to grant it. A published vulnerability disclosure or bug bounty policy provides authorization only within its stated scope.

Do not use Cumbersome to bypass access controls or anti-bot challenges, gain unauthorized access, probe or exploit systems without permission, obtain credentials or protected data, deploy malicious code, conduct phishing or fraud, or disrupt a service. Review generated code and proposed browser or tool actions before using them. The complete restrictions are in our Terms of Service (folding-sky.com/terms).

Other app-authored requests and framing

Some features need additional instructions or request framing to do what their controls promise:

The examples below aren't a comprehensive or version-specific inventory. Cumbersome changes over time, and a released or experimental feature may use app-authored instructions, tools, or request framing that isn't listed here. This page may not always be updated at the same time as the app.

• Automatic titles: This is enabled by default. After you start a conversation, Cumbersome makes a separate request containing the first message and instructions asking the selected AI provider to generate the short title shown in the sidebar. You can disable automatic titles under Settings > Tools.
• Face/Off and Mind/Meld: These are off by default. They make three candidate requests with app-authored role instructions, then make another provider request to judge or synthesize the candidates. The final request includes the candidate responses.
• Ghost/Write: This runs only when you request it. Cumbersome sends the conversation to the selected provider with instructions to draft a possible next message on your behalf. The generated message is clearly marked as AI-written in the conversation.
• Annotations: When you send an annotation, Cumbersome adds the selected passage, your optional note, and bounded surrounding context to the next request. Sent annotations remain associated with that request in the conversation.
• Conversation compaction: This runs only when you request it. Cumbersome sends the selected conversation history with instructions to create a shorter summary for later turns.
• Attachments, PDF extraction, and tool results: Cumbersome can add labels or formatting so the model can understand attached content and tool output. When on-device PDF text extraction is used, the extracted text and filename are inserted into the provider request instead of uploading the original PDF through that path. A photo captured inside Cumbersome stays in the attachment draft until you send the message. Cumbersome then sends it to the provider and can sync it with the saved conversation, just like another image attachment.

These requests use your API key and count toward the provider's token usage and charges.

Our approach to future features

Future features may also require app-authored prompts, system instructions, tool definitions, or small amounts of request framing. We will add them only when they are needed to perform the feature's stated purpose, keep them as focused as practical, and provide a setting or explicit action when appropriate.

Our goal is straightforward: don't surprise you. We will use app-authored instructions judiciously and aim to document significant patterns that can affect model behavior or token usage. This page is an explanation of our approach, not a guaranteed complete or continuously updated feature ledger.

Inspecting provider requests

Cumbersome keeps a sanitized copy of the effective parameters used for each AI response. To inspect it:

1. Open the ellipsis menu on an AI response. You can also long-press the response on iPhone or iPad, or right-click it on Mac.
2. Choose Message Details.
3. Expand Request Parameters.

The parameters reflect provider defaults and your custom values after Cumbersome merges them. If a response required several provider requests, Message Details lists each one in order. This view excludes message content, system messages, tool definitions, and attachments. It also redacts credential values.

This is Cumbersome's copy of the outgoing parameters, not a receipt or billing log from the provider. Provider dashboards remain the authoritative source for usage and charges. They can also show what the provider received. For example, OpenRouter offers optional Input & Output Logging (opens in new tab) in its Observability settings. Review OpenRouter's privacy and retention details before enabling it. Logging applies only to subsequent requests.

For more information, read our Privacy Policy and Terms of Service.