Appearance
Data handling
Pencel is a desktop app, and your workspace lives on your computer, not on Pencel's servers. Some things have to leave your computer for Pencel to work: requests to AI model providers, your sign-in, and the services you connect. This page lists what goes where.
What stays on your computer
Everything in your workspace is kept in a database and files on your computer:
- Your teammates and rooms, their conversations and results
- Documents, Knowledge, Facts, To-dos and Memory
- Workflows, run history and costs
- Settings, and your saved keys and sign-ins (encrypted, see below)
Pencel doesn't copy your workspace to its servers. The workspace itself isn't encrypted by Pencel, so we recommend turning on your computer's disk encryption (FileVault on a Mac, BitLocker on Windows).
What leaves your computer, and where it goes
| What | Where it goes | When |
|---|---|---|
| Sign-in and plan checks | Pencel's account service | Always. You sign in even when you use your own API key. |
| AI requests, with your own API key | Straight to that provider: Anthropic, OpenAI or Google | Whenever Pencel works for you and you've added your own key for that model's provider |
| AI requests, on Pencel's credits | Pencel's model service, which passes them to Anthropic, OpenAI, Google or Fireworks AI | On a paid plan or free starter credits, when you haven't added your own key for that provider |
| Pencel Auto and Pencel Private | Pencel's model service, then Fireworks AI, which hosts the open model these modes use | When you choose either mode |
| Voice input | Pencel's model service, or straight to OpenAI if you added your own OpenAI key | When you use the microphone |
| Slack and QuickBooks sign-in | Pencel's sign-in service completes the sign-in (QuickBooks also renews it there) | When you connect, and for QuickBooks when the sign-in renews |
| Your connected services | That service: for example Google, Microsoft, Intuit, Slack, Notion or Stripe | When Pencel reads or acts in that service |
| RFP searches, market data and shared web search | Pencel's API, which asks the source (GovCon, HigherGov, Finnhub or Tavily) | When a room searches with Pencel's shared access. With your own key for a source, Pencel skips this step. |
| Organizations and invitations | Pencel's account service: your organization's name, its members' names, emails and roles, the addresses invited, and your sign-in session on account.pencel.ai | When you use Pencel Account to create or join an organization |
| Update checks | Pencel's update server | When Pencel checks for a new version |
| Anonymous usage data | Pencel's analytics service | Only if you agree to share it (see below) |
Pencel Private is the zero data retention mode: prompts go only to a provider that doesn't keep them, and Pencel doesn't log their content. It changes nothing about what's kept on your computer. Both Pencel modes run on Pencel credits: a paid plan, or your free starter credits while they last. See Supported models.
What an AI request contains. Your message, the room's goal, instructions and rules, the Knowledge and Facts that are relevant, recent conversation, and whatever Pencel read to do the work, such as an email or a search result. Your saved keys and sign-ins are not part of it. Each AI provider's own data policy applies to what it receives.
How your keys and sign-ins are stored
API keys, connection sign-ins and your Pencel sign-in are saved in your local database, encrypted with a key that your operating system protects (the Keychain on a Mac, your Windows account's data protection on Windows). If your computer can't provide that protection, Pencel refuses to save them rather than store them unencrypted.
- Manage AI model and source keys in Settings ▸ Credentials.
- Manage connections in Settings ▸ Connections. Removing a connection deletes its saved sign-in or key.
- Removing a connection from Pencel doesn't cancel the access you granted on the service's side. Do that in the service's own settings.
Pencel's browser. The Playwright connection runs its own browser on your computer. It keeps the sign-ins you make in it in a folder in Pencel's data folder, which your operating system does not encrypt, so turn on disk encryption as above. It also keeps the screenshots it takes (shown only to you, never sent to an AI model) and the documents it downloads, and deletes screenshot folders after 7 days. Passwords you save for it are stored like your other sign-ins, encrypted by your operating system, and are typed only on the website you saved them for. Removing the Playwright connection in Settings ▸ Connections deletes all of it. The text of a downloaded document is sent to an AI model only when the work needs it, like any other document Pencel reads. See Browser automation.
Anonymous usage data
You choose whether to share anonymous usage data. The first time you sign in, the Terms screen has a box, Share anonymous usage analytics, that is ticked by default because it's what unlocks free starter credits. Untick it if you'd rather not share.
To change your choice later, go to Settings ▸ Privacy and find Share anonymous usage data during beta. The button reads Opt in when you're not sharing and Opted in when you are. Click it to switch.
- What's shared: how long and how often you use Pencel, which views you open (not what's in them), how often you use features such as runs, chats and connections, and cost totals.
- What's never shared: your conversations, documents or workspace data, your keys, and personal details such as your email address or name.
- Error details stay on your computer. Error messages and crash details are recorded locally and aren't uploaded. Only totals, such as how many runs failed, are shared.
If you untick the box, you can still use Pencel with a paid plan or your own API key. See Accounts, plans and credits.
Retention and export
Open Settings ▸ Activity Log:
- Activity log. A tamper-evident record of deletions, approvals, permission denials and use of your saved sign-ins. It's kept for 7 years and can't be shortened below 1 year.
- Export. Choose a Period (Last 30 days, Last 90 days, Last year or Everything) and click Export…. Pencel writes a folder with the events, the runs and approvals they refer to, a plain-language summary and an integrity check. Message contents, document bodies and key values are never included.
- Run history. Choose how long the step-by-step detail of each run is kept: 30 days, 90 days (the default), 1 year or Keep forever. After that, runs keep their outcome and cost, and the detail is summarized.
To keep copies of your documents, export them from Documents.
Deleting your data
Your workspace lives on your computer, so you delete it there:
- Export anything you want to keep, then quit Pencel.
- Uninstall the app.
- Delete Pencel's data folder:
~/Library/Application Support/pencelon a Mac, or%APPDATA%\pencelon Windows.
Deleting the folder permanently removes your workspace, history and saved sign-ins. It can't be undone. Your Pencel account, which you use to sign in and which holds your plan, is separate. To also cut off access you granted to connected services, remove Pencel in each service's settings.