Private Mode is a distinct transport and assurance level. A provider-side TEE route is not automatically a client-to-enclave private route.
The public status endpoints expose an assurance object. A configured server reports not_checked until the browser or local proxy performs attestation. Only fresh verified evidence is eligible. Other states include unavailable, stale, measurement_mismatch, verification_failed, and unsupported.
Evidence is fresh for five minutes. Stale evidence triggers re-attestation; failed, malformed, or mismatched evidence fails closed. There is no automatic plaintext fallback to a standard or ordinary TEE route.
Completed browser requests include a version 2 receipt with the model and enclave identity, expected and observed measurements, release digest, HPKE key fingerprint, freshness timestamps, an opaque request-ID hash, and verifier step statuses. Receipts exclude prompts, completions, API keys, and signed URLs.
Copy or download a receipt from the message shield, then independently re-fetch and compare current attestation evidence with:
npx --yes @nanogpt/private-mode@0.2.28 verify receipt.json
Private Mode accepts router code only from signed releases of tinfoilsh/confidential-model-router. Receipts record this policy as verifier.configRepo; a receipt that names any other policy is not Private Mode evidence. The verifier rejects receipts that name another policy, checks the model claim against its bundled model list, and prints the evidence it checked separately from the receipt's claims.
Attestation covers Tinfoil's router, not which model answered. The model, inference enclave, encryption flags, status, and timestamps are recorded by your browser; attestation does not prove them.
Receipts are browser-generated and unsigned. They do not prove response authenticity, usage correctness, prompt non-retention, or provider retention behavior. The request-ID hash is for opaque correlation, not proof of server issuance.
Private Mode does not enable web search. Tinfoil's search integration sends queries and requested URLs to Exa outside the encrypted inference boundary, so it does not meet Private Mode's confidentiality requirement. Browser-local tools remain available on supported models.
On private models that support tools, chat tools that run entirely in your browser stay available: calculator, current time, questions to you, and spreadsheet, PDF, presentation and ZIP files. Each model step in a tool-using reply is a separate encrypted request; tool arguments and results travel only inside those requests and your local chat history. Spreadsheet, PDF and presentation files are stored on this device; ZIP archives are built in your browser when you download them.
NanoGPT can see that a reply took several requests, with their timing and sizes, and bills each one at its own usage. Tools that send data to NanoGPT or another service, such as ordinary web search, reading links, image generation and connectors, are unavailable in Private Mode.
Conversation history stays local by default. Private Mode messages are blocked from ordinary cloud sync; passphrase or passkey end-to-end sync is required. Provider-reported Tinfoil usage remains trusted for billing and is not currently end-to-end signed. NanoGPT does not implement attestation-gated KMS release of upstream provider credentials.
See the broader privacy explainer and privacy controls guide for storage, identity, payment, and provider-specific boundaries.