Keeping your work private, part one: zero data retention

Every model in Bearly's picker now carries a retention badge, and App Settings → Settings → Privacy has a switch called ZDR models only. Turn it on and Bearly will only use models whose provider keeps nothing after answering. Today that covers 18 of the 24 models in the picker, including the current OpenAI, Anthropic, and xAI flagships.

This is the first of a few posts about what happens to your work inside Bearly. It starts with the part we get asked about most: what the model provider keeps.

A narrow promise

When you send a message, the provider running the model receives your prompt. Most keep a copy for a while afterward — thirty days is a common default, held for abuse monitoring — and some consumer tiers allow a human to read it.

Zero data retention is the arrangement where that does not happen. The provider processes the request, returns the response, and retains neither. It is a narrow promise, which is what makes it worth having. It covers the leg of the trip we don't own.

The route, not the model

Zero data retention is not a property of a model. It's a property of the route: which host serves that model, under which contract, with which request options.

The same model can be available from several hosts on very different terms. So for each one, the work is to find a host that will contract for zero retention, confirm the terms in writing, wire the route so the request itself doesn't opt into storage, run it live against real tool-calling conversations, and only then label it in the picker.

The label goes on last for a reason. A provider option named for disabling storage is a claim about a request, not proof of one, so the check is what the request actually contains and what the contract behind the host actually says. Until both hold, the model stays Standard. An unverified answer is never rounded up.

The other rule: the picker keeps the name you know. When a model reaches you over a zero-retention host, it is still that model, under that name. You don't have to hunt for a privacy-flavored variant of the thing you wanted.

The switch

ZDR models only is off by default and lives in App Settings → Settings → Privacy. With it on:

• The picker lists only models with a verified zero-retention route.
• Automatic fallbacks obey the same rule. If your first choice is unavailable and Bearly retries elsewhere, it retries on another zero-retention route.
• A conversation still set to a model without one runs on a comparable model that has one, instead of sending your message to the original.

The setting belongs to your account rather than one device, so it follows you to web, desktop, iOS, and Android.

It also fails closed. If Bearly can't reach your synced settings, it enforces zero-retention routes until the connection recovers, and leaves the switch unavailable while that's true. Failing open would have been easier and quieter, and it would have meant a sync hiccup silently downgrading a privacy choice you made on purpose.

Team administrators get the same information one level up. The model list in a team policy shows the same badge, so an admin can build an allow-list of zero-retention models for everyone.

What it doesn't cover

The setting governs chat models: the replies, and the reasoning and tool-calling steps inside them. It does not govern image and video generation, text to speech, transcription, or text extraction from uploaded documents. Those run on separate models. Tools that reach outside services — web search, maps, connectors — still send the query they need to the service handling it. Turn a tool off in Chat Settings when a task shouldn't reach outside services at all.

Where capability and privacy pull apart

Two families in the picker read Standard today: Google's Gemini models and Claude Fable 5.

We could clear that line by dropping them. We'd rather not. Fable 5 writes in a way nothing else here does, and no host offers a zero-retention route for it — on that model, nobody can currently do better. Dropping it would cost you the model and buy you nothing.

So the badge does that work instead. What we're after is the frontier of both: the most capable models available, each on the most private route it can actually run on. When a model can have both, we go get the route, which is why most of the picker now sits on the ZDR side. When it can't yet, you get the model and a truthful label, and you choose per task. Or you turn the setting on and work only with the models that keep nothing.

None of this changes what Bearly itself stores and encrypts on your behalf. That is a separate subject, and where this series goes next.

Open App Settings → Settings → Privacy to turn it on. The zero data retention guide has the details.