Own your intelligence

Not for the engine. The command line, the server and Studio never ask who you are: install, pull a model and run it. The macOS app is the one exception — it asks you to sign in with a free llamay account the first time you open it. Beyond that, an account only matters if you want llamay to run models too large for your machine, or your conversations waiting on a second machine.

One line on macOS and Linux — curl -fsSL https://llamay.com/install.sh | sh — or the download page for the Mac app, the Windows installer, a .deb, a .rpm or a plain tarball. The script checks the download against SHA256SUMS before it installs anything.

Almost certainly. A small model runs comfortably on any machine from the last few years, and llamay uses the GPU you have — Metal on a Mac, CUDA or Vulkan elsewhere — with no toolkit to install. The download page picks the right build.

By name — llamay pull qwen2.5:7b — or from Hugging Face, or from a plain URL. If you already use Ollama, llamay reads its store where it sits, so your existing models work without copying anything. More on models.

Nothing is billed for what runs on your own machine: no trial, no card, no ceiling, and no count of how much you used. Commercial use needs a seat licence, below.

Not for a local model. Beyond what you ask it to fetch — a model you pull, or your directory's signing keys if people sign in through one — the engine makes one network call of its own, a once-a-day check for a new version, and LLAMAY_NO_UPDATE_CHECK switches that off. It goes to GitHub's release API and carries nothing about you. There is no telemetry, no analytics and no crash reporting in the binary.

Then that turn leaves your machine, because that is what you asked for. It goes to llamay's service and from there to Cloudflare Workers AI, which runs it. llamay does not train on anything; retention on Cloudflare's side is governed by Cloudflare's terms rather than by a promise we can make for them. Local models are never involved.

No. Not by us, not ever, and for a local model the question cannot arise — the text never reaches anybody.

Models in ~/.llamay/models. If you sign in, a session token in ~/.llamay/account.json, mode 0600 in a 0700 directory. Memory facts and any connector tokens sit beside it at 0600. Conversations in Studio live in your browser's storage. A snapshot file is the conversation — treat it with the same care as the transcript it came from, or have the server seal every snapshot with AES-256-GCM by giving it -context-key. What is written down.

A short list of facts about you — at most 60 of them — kept in a file you own and put in front of each conversation. Signed in, a copy goes to your own storage so every machine sees the same list. The service keeps no memory table of its own. Forgetting something is deleting a line in a file.

Conversations — a few kilobytes each — on every plan including free. Attention state, which is what lets a conversation resume on another machine without re-reading itself, is 140–450 MB per snapshot, needs Pro, and is off until you turn it on.

In transit, yes: https throughout. Synced conversations go from your machine straight to storage over a signed link, without passing through our service; files you put in the drive stream through the service on the way, so their size is counted as it arrives. At rest they sit in Cloudflare R2 under a prefix only your account can name. This is not end-to-end encryption. We hold the storage credentials, so we could read those files. We do not, and the service is built so our own database cannot reconstruct a transcript from itself — but we are not going to claim a guarantee we have not built.

Yes, both, from the Your data section of your account page. Download my data hands you one JSON file of everything the service holds for you: the account, your API keys (never their secrets), licences, the credit log, and every synced conversation and your memory file, with links that work for an hour for attention-state snapshots and drive files.

Delete my account asks you to type delete my account, then cancels any subscription, revokes every key, deletes every conversation, snapshot and drive file, clears the credit balance and any seat licences, and removes the sign-in itself where the service can. If the subscription cannot be cancelled, nothing is deleted and you are told so. What stays is Polar's: as merchant of record it keeps orders and invoices, as tax law requires. What is on your own machine was never ours to delete.

Yes, and it is the default. Point llamay at your own Cloudflare R2 bucket and we are not involved at all — no account, nothing to trust.

Yes. Sign in on each. Conversations sync on every plan; attention state following you between machines needs Pro.

Us running a model for you, and storing more than a gigabyte. Anything that runs on your own machine is not billed, and neither is syncing conversations between your own machines.

Only inference we run. Anything on your own hardware is uncounted and unlimited — there is no meter in the binary to read. On the hosted side an allowance is measured in tokens, and a turn that uses tools, searches the web or delegates spends one for each step it takes.

You are told which limit and when it lifts, and nothing is lost. The monthly allowance renews on the first of the calendar month; the daily one is a rolling 24 hours, so the next request goes through once the earliest of today's falls out of it. Reading what you have already stored is never refused, on any plan, in any state.

In the billing portal, which opens from Settings without asking you to sign in again. It takes effect at the end of the period you have paid for.

Polar, as merchant of record. Polar's name is on your statement, Polar handles the tax, and llamay never sees or stores a card.

Yes, for commercial use: a seat licence, one per person, $1000 a year with the first year free. The engine itself is unchanged by it — llamay runs identically with a licence and without one, nothing is gated, and nothing stops working if a licence lapses. What a seat buys is the right to use it commercially, and something an auditor can check.

No. A licence is a signed file: llamay checks the signature against a key compiled into the binary, on your machine, with no network call at any point. That is why it works in an air-gapped building, and why no outage of ours can stop you working. You can check one yourself at llamay.com/verify — that page sends nothing either, and the licence you paste never leaves the tab.

You drop to free. Nothing is deleted and nothing is held back: conversations keep syncing, everything you stored stays downloadable, and your local models carry on. What stops is new attention-state snapshots uploading. One limit: if what you stored comes to more than twice the free plan's room, new conversations wait until you delete some.

It listens on localhost:11435 — loopback, not the network. No CORS headers at all unless you name origins. Shell access is off unless you turn it on, and turning it on means naming a directory. The security page has the detail.

Yes, with every caller named: by an API key, stored as a SHA-256 digest and never in the clear; by a token from your directory — Entra ID, Okta, Keycloak, Ping or Clerk; or by a smart card's certificate over mutual TLS. The engine serves TLS itself, and -profile enterprise refuses to start on a reachable address without names, TLS and an audit record. Each caller's name lands in the audit record. Signing in with your directory.

Yes, and it is hash-chained: each record carries the hash of the one before it, so altering a record breaks every record after it and removing one breaks the link across the gap. It records what was asked — route, status, timing, token counts — and never the conversation. A test asserts the record has nowhere to put content. -audit-syslog also hands every record to the machine's syslog daemon, for a SIEM. An estate whose rules require the conversation itself turns on capture, which keeps an encrypted copy of each request and response in its own directory, each naming the audit record it belongs to.

Yes. macOS builds are Developer ID signed, notarised and stapled; Windows builds are signed through Azure Trusted Signing and then independently verified in CI, because an action exiting zero is not the same as Windows accepting the signature. Every release carries SHA256SUMS, and a Sigstore bundle that signs it.

go.mod requires nothing. Not a short list — an empty one. The engine is the Go standard library and llamay's own code, which is why it is one binary with no runtime to install — fully static in the portable builds, and linked only to the system's Metal or GPU driver in the accelerated ones.

No. There has been no third-party penetration test and no external security audit. What exists instead is a large test suite around the guards specifically, an end-to-end run inside a loopback-only network namespace on every change, and a list of defects found and fixed during internal review. If you need an audit before you can deploy, tell us — that is a conversation worth having.

Email [email protected]. Please do not open a public issue with a working exploit in it.

Yes, and it needs no special build. Pull a model on a connected machine, copy the binary and the model directory across, and run. Weights are content-addressed, so a hand-copied file verifies exactly as a downloaded one does. The unlicensed engine has no licence check at all; a commercial seat carries a signed licence file you copy across with the binary, and it is checked on the machine itself. Either way there is nothing to call home to.

Yes, for commercial use — $1000 per person a year, with the first year included. Running it for yourself needs no seat, on as many machines as you own. A seat is a signed file rather than an account: nothing is gated by it, nothing stops working without one, and it is checked on your machine with no network call at any point.

Yes — a SOC 2 Type II report, covering an observation period rather than a single day. Ask and we will send it under NDA. ISO 27001 and a HIPAA BAA we do not have, and we would rather say so than let one report stand in for all three. Worth adding, because it is the stronger argument: a report attests to how the hosted service is run. Run llamay locally and there is no processor to assess at all — no cross-border transfer to justify, and no retention question about a prompt somebody else is holding.

Wherever Cloudflare places it — we do not currently offer a residency choice. If residency is a requirement, run locally, where residency is a property of your own hardware.

For the hosted service: Cloudflare (compute, inference, storage), Clerk (sign-in) and Polar (payments). Model downloads go to Hugging Face. Web search, when a turn uses it, sends the query to whichever search provider answers. Local inference has none of these.

The binary you have keeps working, and nothing in it stops working when a licence does — the engine is never gated. There is no activation and nothing to phone home to, the dependency list is empty so there is no upstream to rot, and there is no llamay model registry to go dark — llamay fetches from other people's registries and hosts none of its own. What you would lose is the hosted service and anything stored in it.

Proprietary. Download and run on as many machines as you own, for any purpose including commercial use, and anything you produce with it is yours. The licence is the LICENSE file in every download. Releases up to and including v0.1.71 were published under Apache 2.0, and that grant stands for those versions.

Not yet. There is no uptime commitment and no response-time target to point at. For anything that needs one, write to [email protected] and let us talk rather than have you discover the gap later.

ChatGPT runs on somebody else's computers and everything you type goes there. llamay runs on yours. It works on a plane, it keeps working if a company changes its terms, and nothing you write is anywhere you cannot reach. The trade is honest: the very largest models still want hardware you probably do not own.

One thing mainly, and it is the thing this whole site is about: a context here is an object you can fork, snapshot to a file and restore in a different process on a different day. Everywhere else it is a buffer that dies with the program. The state engine.

No. It is written from scratch in Go, with nothing outside the standard library. The portable builds have no cgo at all; the Metal and GPU builds use it only to call Apple's Metal and Accelerate and the GPU driver.

Not at decoding, no. llama.cpp is faster at generating tokens on every platform we have measured, and we publish the table with our losing column in it. Where llamay wins is not recomputing: restoring a 2,048-token conversation takes 74 ms against 3.149 s to read it again. The numbers.