Keys and chats stay in this browser's localStorage. Requests go directly from your device to the provider, which must allow CORS.