All Pouch data in this browser was erased. Pouch recreates its empty databases as it starts, so the browser's storage tools will list them again, empty.
Pouch is a coding agent for files kept in this browser; what it asks the AI is encrypted so that BayLeaf cannot read it.
work is this browser, pouch holds shared instructions and skills, tmp is memory (gone on reload), and mounted folders are on your device.
On a borrowed computer: Download all, then Erase all before you leave.
No file open. Pick one in Files, or open a path from a reply.
Your conversations and files stay in this browser. Each model request is encrypted here, to an enclave whose hardware attestation and published code this page verified. BayLeaf relays ciphertext and sees who you are (your key, or your IP under Campus Pass), when you send, how many bytes, and which model ran. It cannot read prompts, replies or the file contents your agent reads. The agent's tools run in this page, not on a server. The weakest link is this page itself.
The bayleaf command can send data outside the pouch; Pouch asks you every time.
Web search and fetch, the sandbox VM and inboxes are plaintext to BayLeaf (not logged, by policy) and some reach third parties.
Each request shows exactly what goes and who can see it, and a denial sends nothing.
This page talks only to api.bayleaf.dev: its Content-Security-Policy (connect-src) says so, and the browser enforces it.
Build d286752+dirty 2026-10-29. A page cannot vouch for its own hash, so this one does not show it. Save the page, then compare its hash with SHA256SUMS from the release:
shasum -a 256 pouch.html
Display preferences only, saved in this browser. They do not enable reasoning or change model reasoning effort. Existing messages keep their own open/closed state while streaming. Erase all resets these preferences.
The model below your message applies to your next user turn. Running work, including subagents, keeps the model it started with.