Privacy and costs
What is sent where, what costs money and where your files are kept.
What leaves your machine#
Model Hub sends your prompts, and any note text you or a plugin include, only to the providers you add. In the note chat, that includes what the chat reads with its vault tools: other notes' text, outlines and properties it looks up to answer you (see Let the chat look things up).
| Where | When | What is sent |
|---|---|---|
OpenRouter (openrouter.ai) | You added OpenRouter and a call uses one of its models | The prompt and included text; requests for its model list and prices |
Anthropic (api.anthropic.com) | You added Anthropic and a call uses a Claude model directly | The prompt and included text |
OpenAI (api.openai.com) | You added OpenAI and a call uses one of its models | The prompt and included text; a request for its model list |
Google (generativelanguage.googleapis.com) | You added Google Gemini and a call uses a Gemini model | The prompt and included text; a request for its model list |
Azure (<your resource>.openai.azure.com, or the base URL you entered) | You added Azure OpenAI and a call uses one of your deployments | The prompt and included text |
xAI (api.x.ai), Mistral (api.mistral.ai), DeepSeek (api.deepseek.com), Groq (api.groq.com), Cerebras (api.cerebras.ai) | You added one and a call uses one of its models | The prompt and included text; a request for its model list |
models.dev (models.dev) | A provider you use is priced from it and its prices are over 7 days old or are still the bundled ones, you switch on a provider the saved prices don't cover yet, or you select Refresh prices | A request for its public price list. No key, and nothing from your vault or your prompts |
OpenRouter rankings (openrouter.ai) | A paid provider is on and the saved rankings are over a day old, or you select Check for better models | A request for this week's public model rankings, with your OpenRouter key if you added OpenRouter. Nothing from your vault or your prompts |
OpenRouter key report (openrouter.ai/api/v1/key) | OpenRouter is on and something asks what is left: the note chat opens or finishes a reply, the usage view opens, or a plugin calls spend(); at most once every 5 minutes | Your OpenRouter key, to read the key's limit and usage. Nothing from your vault or your prompts |
TypeSafe (api.typesafe.ai) | You added TypeSafe and a plugin makes a decision call, or the note chat suggests a skill for your question | The decision's text (for a skill suggestion: the question you are typing and the skills' names and descriptions) |
| Ollama, LM Studio or llama.cpp | You added one | The prompt, to the server on your own computer |
| LiteLLM | You added it | The prompt, to the address you entered |
| Another endpoint | You added it | The prompt, to the address you entered |
| Your OpenTelemetry collector | You turned on Send traces | The role, model, tokens and cost of each call, and each tool call and undo (tool name, ids, outcome, error code, a hash of its arguments); never your text, arguments or tool error text |
Web research sends your question to the provider's web search.
Test on a provider's dialog, and Refresh model lists, send one request with your key to check that the provider accepts it (OpenRouter's key report, or the provider's model list). Nothing from your vault is in it.
The MCP server is not a place your data goes. It is off until you switch it on, it listens only on 127.0.0.1 on your own computer, and a client needs its token. It sends nothing out: it answers programs on this machine. See Use Model Hub from Claude Code, Claude Desktop or Codex. An agent you connect, such as Claude Code, has its own provider and its own policy for what it does with what a tool returns. A skill you mark mcp-prompt: true is sent, with its files, to any connected client that asks for it.
Nothing is sent to the plugin's author. There is no telemetry, no account with us and no ads.
In the note chat, the chip under the header shows whether the open note goes with your question. With a selection, the whole note is sent too. Notes and Bases embedded in the open note are sent with it. With a model that can use tools, the chat can also read other notes while it answers; what it read is listed above the reply. It can propose edits to notes, which you approve in a dialog showing the change; nothing is written without that approval unless you set the tool to Allow. If you turn on Suggest a skill for your question (off by default, in the Skills page), the question you're typing (not the note) goes to the Decision tier after a pause, with the skills' names and descriptions, to suggest a skill. It is also sent a short map with each question: your top-level folder names with their note counts, the open note's path and your open tabs' paths, but no note text. The selection commands send the selected text and up to 1 500 characters either side of it, nothing else. Model Hub never reads or sends files under Excluded files; another plugin's tool offered in the chat follows that plugin's own rules. See What the chat sees.
What costs money#
- OpenRouter, Anthropic, OpenAI, Google, Azure, xAI, Mistral, DeepSeek, Groq, Cerebras and TypeSafe bill your account with them for each call. Model Hub is free; the label on its listing is Optional payments because of these services.
- Ollama, LM Studio and llama.cpp cost nothing per call. LiteLLM costs what the models behind your proxy cost.
- In the note chat, each tool look-up is another call, up to 8 per reply. Each is checked against your limits.
- To cap spending, set Per call and Per month on each tier: see Set up tiers and limits. Both are checked before a call is sent.
- To see spending, open the usage view: see See what you spent. The note chat shows this chat's cost, what is left of the month on the tier in use and each provider's figures above the input: see Budget and context.
Where things are kept#
| What | Where |
|---|---|
| API keys | Obsidian's keychain. Never in the settings file. |
| Settings (providers, tiers, roles) | data.json in the plugin's folder, inside your vault's configuration folder |
| Prices from models.dev | prices.json in the same folder; it holds prices only |
| The ledger of calls | ledger.jsonl in the same folder. Each row has the call's plugin, role, model, tokens, cost and outcome, and the note or file a plugin names as the call's subject; never the prompt or the reply |
| The tool-call log | tool-calls.jsonl in the same folder. Each row has the time, the run, who asked, the plugin and tool, whether it read or wrote, how it ended and how long it took, the error code and message if it failed, and the undo handle a write returned. The arguments are kept only as a SHA-256 hash, never as text. Tool authors are told to keep note text out of error messages. |
| Edit snapshots | snapshots.jsonl in the same folder. Before each change the chat, a selection command or a plugin makes through the edit engine, the whole note as it was, so the change can be undone. Kept 30 days, and at most 20 MB (oldest dropped first). |
| The MCP token | Obsidian's keychain, like your API keys. Never in the settings file or the log |
| Your skills | The vault folder you name under Skills folder |
Model Hub reads and writes nothing outside your vault, and runs no other programs. The one thing it can open is the optional local server above, which you switch on yourself.