What makes it privacy first?

Shouldn't it use local llm then?

Does it send my password to a provider when it signs up to a website for me?