Your API key is stored only in this browser (localStorage) and is never included in EXPORT backups. Requests go: browser → this site's own relay (/api/chat) → your chosen provider, carrying your key with them each time. The relay does not store or log keys — it only forwards the request. Bring your own key means you pay your own provider directly; nobody else's usage touches your account, and yours doesn't touch anyone else's.