Your API key is stored temporarily in browser memory and never sent to any server except Google's Gemini API.