Privacy

A room is a shared conversation. Everyone in it can see the questions and answers, on purpose. No server sees them.

Run rooms with people you would share a document link with, not with strangers.

Who sees what

Who	What they see
The host	Every question and answer, always. The host’s device reads your message and picks each word.
Everyone else	Questions and answers, unless the host limits it (below).
Devices that hold layers	A hidden form of every message. Not text, but not private either.
The signaling server	That devices want to meet, and their network addresses. Never your messages.
pooled.run	Nothing from the room. The site is static files.

Limit who sees the chat

The host sets Who sees the chat in Room settings:

• Everyone (default): every screen shows the chat.
• Only me: only the host’s screen shows it.
• Whoever asked: each answer goes to whoever asked it, and to the host.

It applies to chat, Code mode and requests from the Serve API.

This does not hide your words from the room

The setting decides which screens show the text. The devices running layers still work on a hidden form of your words, and published attacks recover much of the text from it. Assume anyone in the room can read your prompts.

What Pooled cannot promise

• Nobody checks another device’s work. A device could send back altered results.
• Weights shared inside the room are not checked. A device can take layers from another device’s cache. Add ?peerweights=0 so every device downloads from Hugging Face instead.
• Devices see each other’s IP addresses when they link directly. To hide yours, add a relay under Network and tick Always go through the relay. See Networks and work Wi-Fi.

Tools on the Serve API

Everything a tool sends goes to the room. Coding tools send file contents and sometimes secrets, so point them only at a room you trust. The host’s screen shows each API request and its answer, and so do the others’ screens unless the host limits who sees the chat.

What stays on each device

• Cached weights. Delete them in Room settings.
• Conversation checkpoints, so a reload can pick up where it left off. ?ckptdisk=0 turns this off.
• Code mode files, in the host’s browser or a folder the host picked.
• Your relay settings, in that browser only. They never go into join links.

The full threat model is in Security model.