Why BYOK and local-first

Most tools ask you to trust them. OpenDesign is built so you do not have to. Two decisions carry most of that weight: bring your own key (BYOK) and local-first. Neither is a feature bolted on the side. They are the shape of the whole thing.

Your key, your model, your cost

BYOK means exactly what it says. You supply the API key. You pick the model. The bill comes from your provider, priced at their rate, with no markup and no middleman reselling access to you.

That changes the relationship. When a tool resells you model access behind a subscription, its incentives and yours quietly diverge. It wants you inside its meter. When you bring your own key, there is no meter to be inside. You choose a cheap local model for the hundred small iterations and a frontier cloud model for the one that matters, and you see the cost of each as you go. The tool's job is to be good, not to ration you.

Receipts, not promises

"We respect your privacy" is a promise. Promises are hard to check. We would rather give you receipts.

• On first launch, OpenDesign makes zero network requests. You can watch the network and confirm it.
• Your keys live in the OS keychain, not in our database, because there is no database.
• Every outbound call is written to a local, append-only audit log at ~/.opendesign/audit.log. You can read exactly what left your machine and when.
• All of your state sits in one directory on your disk. Delete it and everything resets. There is no hidden copy on a server somewhere.

A claim you can verify is worth more than a policy you have to believe. Local- first is what makes verification possible: when nothing has to leave your machine, "we can't see your work" stops being a pledge and becomes a fact about how the software is built.

The 80/20 of local and cloud

Local-first does not mean local-only. The honest split, in practice, looks something like 80/20.

Most of the work (the quick iterations, the "try it three more ways", the messing about that is how design actually happens) runs beautifully on a local model. It is fast, it is free, and it never leaves the room. That is the 80.

Then there is the 20: the hard screen, the tricky layout, the moment you want the strongest model available. For that, you reach for a cloud provider with your own key, pay for exactly that call, and go back to local. You are not locked into one mode. You move between them based on what the task needs, and you keep the bill and the data under your own control the whole time.

That is the point of BYOK and local-first together: the cheap, private path is the default, the powerful path is one key away, and both of them answer to you. It is your key, your model, and your machine, and the tool is built to keep it that way.