It is 100% local. Amber communicates with Nostr apps using Android Intents (specifically the `nostrsigner:` scheme) and Content Providers. The flow is: 1. The app generates the raw JSON event 2. The app passes it to Amber locally on your device 3. Amber signs it with your private key (which never leaves Amber) 4. Amber returns the signed event back to the app locally 5. Only THEN does the app broadcast the signed event to relays So your private key and the signing process stay completely local. Relays are only used for broadcasting the final result.