← Back to the playground

Privacy and hosting

This is an open-source playground for LM15, not a service that runs models for you. Bring your own provider account and API key. Sending messages may cost money on that account.

Where your information goes

• Your browser sends messages and the selected provider's key directly to that provider. That provider's privacy rules apply to those requests. The one exception is the relay, which is off until you allow it for a provider.
• GitHub Pages hosts the public files and handles normal hosting traffic, including your IP address. The app does not send your keys or messages to GitHub, and includes no analytics, advertising, or third-party scripts.
• In Chat, the conversation stays in the page's memory and is lost on refresh. It is sent again to your provider with each turn so the conversation can continue.
• In Judge, the questions, the inputs and their answers are kept in this site's browser storage (unencrypted: they are not secrets) so a set survives a refresh. Clear results drops the answers; removing the inputs drops the rest. Nothing of it leaves the browser except the request to your provider, one per input.
• Keys also stay in memory unless you choose Remember on this device. Remembered keys are encrypted in this site's browser storage. Forget deletes them. Keys stored on localhost or a different website do not carry over here.
• Encryption does not protect against scripts running on this page: they must be able to use the key to send a request. Only use the playground if you trust this site and its updates. Prefer limited-budget keys and revoke keys you no longer need.

What this hosting setup can and cannot do

GoDaddy manages the address. GitHub Pages serves the files and provides HTTPS, the encrypted browser connection. JavaScript, Python via Pyodide, the Rust WebAssembly codec, and Go compiled to WebAssembly run in your browser. Python, Rust, and Go load only when selected; Python downloads about 13 MB the first time.

Browser access is controlled by the model provider. A provider that blocks browser requests fails here first, and the page then offers the relay below; nothing is routed anywhere without that choice. For local HTTP model servers, use the local playground; the public HTTPS site allows only HTTPS requests.

The relay

Some provider APIs refuse requests from web pages altogether (TypeSafe's does, checked 2026-09-18). For those, lm15 runs a small relay: a Cloudflare Worker, about ninety lines, that forwards the request to the provider and adds the permission headers the provider left out.

• It is used only after you allow it for a provider, and only for that provider. More → Relayed providers shows what is relayed and turns it off.
• While relayed, your API key and your messages pass through that server on their way to the provider. Its code writes no log, and Cloudflare's request logs are disabled for it; Cloudflare still carries the traffic, as any host would. Prefer a limited-budget key.
• It forwards only to the providers it lists and only for this site's pages; it is not an open proxy.
• The code panel shows the relay address as the SDK's baseUrl. Outside a browser, drop that line: the SDKs call the provider directly.

GitHub Pages does not let us set custom HTTP security headers. The page uses a restrictive Content Security Policy to limit scripts and connections, but that is not equivalent to a server-controlled policy. Do not embed this playground in another site.

Releases use versioned asset addresses so a cached script cannot silently mix with a different release's libraries. A new release may require downloading the runtimes again. Reload an old tab if a runtime can no longer be loaded after an update.

Source and licenses

Website and playground · TypeScript · Python · Rust · Go · Published source revisions and file checksums

• LM15: TypeScript license, Python license, Rust license, Go SDK license.
• Go standard library and WebAssembly support: Go license.
• Rust standard library: MIT license or Apache license. Corresponding source.
• Rust dependencies: license notices. Dependency versions and source locations are listed in the pinned Rust repository's Cargo.lock.
• Pyodide, distributed unmodified: Mozilla Public License 2.0. Corresponding source.
• CPython 3.13.2, included in Pyodide: Python license and acknowledgments. Corresponding source.