Optional providers and data routes
Scribble sends content only when you configure an external service and initiate a feature that needs it. Before sending personal, confidential or regulated information, read the current provider documents and your account controls.
1. How routing works
The current Scribble build has no RQAI AI prompt proxy. A request is assembled on your device and sent over HTTPS to the endpoint shown by the selected preset. It can contain the prompt, conversation, selected/relevant note content, writing-voice profile, image or temporary audio needed for that request. Your key authenticates directly with the external service. RQAI cannot see a provider account merely because it is configured in your app.
Provider names, models, aliases, terms and data practices change. The links below are provided for review, not as a promise that a provider will retain its current policy.
2. Direct AI providers
| Choice | Recipient and route | Documents / important point |
|---|---|---|
| Google Gemini | Google Gemini API endpoint | Gemini API terms and Google privacy. Check the terms applying to free/paid API data. |
| Anthropic Claude | Anthropic API endpoint | Commercial terms and privacy. |
| OpenAI | OpenAI API endpoint | Business terms and privacy. |
| Groq | Groq API endpoint; also available for cloud transcription where configured | Terms and privacy. |
| DeepSeek | DeepSeek API endpoint. DeepSeek identifies Hangzhou DeepSeek Artificial Intelligence Co., Ltd. and states that it directly collects, processes and stores personal data in the PRC. | Privacy policy and Terms. Its documents describe inputs, retention, service improvement/model training and an opt-out route; they also impose eligibility and AI-output labelling obligations. Avoid sensitive/confidential content unless your assessment permits it. |
| Custom endpoint | The base URL entered by the user, if allowed by Scribble’s security policy/build | You are responsible for identifying the operator, contract, location, retention, security and lawful transfer before use. “OpenAI-compatible” describes an API format, not a privacy standard. |
3. OpenRouter is a routed service
An OpenRouter request is received by OpenRouter and forwarded to a model provider/endpoint. Scribble defaults new OpenRouter configurations to the maintained Gemini Flash Latest alias, but the backing model or endpoint can change; users can select another model. Both layers’ terms and data handling can matter.
- OpenRouter Privacy Policy
- OpenRouter Terms
- Data collection and logging controls
- Zero Data Retention routing
OpenRouter states that prompt/response logging is controlled by account settings and that model providers have differing retention/training practices. It also records request metadata. Selecting a model does not by itself guarantee a particular country, endpoint or zero-retention policy.
4. Dictation routes
- Local Whisper: audio stays on device after the model is downloaded; model/CDN servers still receive ordinary download requests.
- Browser Web Speech: controlled by the browser/OS and may be local or vendor-operated.
- Cloud Whisper: temporary audio goes to the selected supported Groq/OpenAI provider. Scribble does not save it in the notebook unless you save the resulting text, but provider handling still applies.
5. Sync and publication
- Google Drive: Scribble uses the Google application-data area when configured.
- OneDrive: shown only when the required application registration is available; uses the configured Microsoft app folder.
- GitHub: publication/sync writes to the owner, repository, branch and paths you configure. Public repositories expose published content publicly.
Disconnecting Scribble stops future use of a credential but does not necessarily erase remote files, provider logs, versions, backups or account records. Delete/revoke through the relevant provider as well.
6. Business, regulated and child-related information
Do not assume BYOK makes a provider suitable for professional, clinical, legal, education, employment or other regulated content. An organisation should approve providers, complete its own DPIA/transfer/security assessment and prevent unapproved endpoints. External services also have their own age and guardian requirements; do not connect one for a child unless its terms and applicable law allow it.