How to build or choose a private personal AI

On this page

• Three requirements that drive the design
• The answer is hybrid: local first, confidential cloud when necessary
• Storage follows computation
• Five components of privacy-focused storage
• What has changed since 2025
• Ownership: your data is your business
• Checklist: ten questions to ask any personal AI
• Closing thought
• Frequently asked questions
• Sources

The earlier parts covered why privacy matters in personal AI, the three states of encryption, the technologies for encryption in use and how the largest platforms run confidential AI today. This last part puts it together: a reference architecture for a private personal AI, based on the design we described for Kin in 2025, what has changed since, and a checklist you can use to judge any personal AI, including the one you might build.

Three requirements that drive the design

When we designed Kin, three requirements shaped every privacy decision. They apply to any serious personal AI.

1. It must be fast, capable and affordable. Every round trip to the cloud costs money and latency.
2. It must work around the clock, also when the app is closed. A personal AI that can only think while you look at it cannot follow up, prepare a briefing or carry out a task you delegated.
3. It must use state-of-the-art models. The best language models are far too large for a phone.

The first requirement pulls toward the device. The second and third pull toward the cloud. Privacy has to survive both.

The answer is hybrid: local first, confidential cloud when necessary

Measured against the options in part 3, two approaches fit: on-device processing and confidential cloud computing. Fully homomorphic encryption would be ideal but is too slow for language models, multi-party computation adds network complexity a consumer product cannot carry, and zero-knowledge proofs solve a different problem.

So the architecture we chose, and the one I would still recommend, is local first, with confidential cloud computing only when necessary: on the device by default, and in a trusted execution environment for large-model inference and long-running background tasks.

Since 2025 the device side has become far more capable. Apple’s on-device foundation model has about 3 billion parameters, compressed to roughly 2 bits per weight, and developers can call it directly through the Foundation Models framework. Google offers Gemini Nano to Android apps through its ML Kit Prompt API, and OpenAI says its open-weight gpt-oss-20b runs on machines with 16 GB of memory. Everyday tasks such as summarising, classifying, extracting and searching your own data can increasingly stay on the device.

Storage follows computation

Where data is processed decides where it has to be stored:

• For on-device models, your data has to be available locally, so it is stored on your device.
• For cloud models and background work, the data has to be reachable from the cloud while the app is closed.

That creates two hard problems: synchronising local and cloud copies without the server reading them, and letting cloud-based AI work on the data without exposing it to the provider.

Five components of privacy-focused storage

The design we described for Kin had five components. They still form a sound blueprint.

1. Local-first data. The primary copy lives on your device. That improves privacy, cuts latency and means the app keeps working offline.
2. Synchronisation. Devices sync with each other through a server that coordinates but cannot read, so a phone and a laptop stay consistent without the server holding plaintext.
3. End-to-end encryption. Everything sent to or stored in the cloud is encrypted with keys the provider does not hold.
4. AI-ready data structures. Embeddings and indexes are built so retrieval works on the user’s own data, and they are treated as just as sensitive as the text they come from, because an embedding can leak its source.
5. A permission layer. Multiple keys and explicit grants decide which parts of your data a cloud enclave may decrypt for which task, so a background job that drafts your weekly summary cannot also read your health notes.

The local-first software community has made this pattern much easier to build since 2025. Automerge 3, released in July 2025, cut memory use by more than ten times, and the project is building end-to-end encryption and access control (Keyhive) directly into its sync layer. Building local-first with encrypted sync is no longer a research project.

What has changed since 2025

Three things have moved enough to change the design.

Confidential computing has become mainstream, and its limits are clearer. In 2025 a confidential cloud for AI was a bet. Today Apple, Google and Meta all run one at scale, as part 4 describes. At the same time, the physical attacks published in 2025 showed that enclaves protect against a remote or curious operator, not against someone with hands on the server. A good design treats the enclave as one layer and keeps data minimisation and short retention as the others.

On-device models are good enough for more. A phone-sized model will not replace a frontier model, but it can now handle a large share of the routine work: triage, retrieval over your own notes, summaries and drafts. Every task that stays on the device is a task that never needs a confidential cloud at all.

Fully homomorphic encryption is getting closer, slowly. In 2025 we estimated FHE for language models to be about five years away. Progress is real: Zama became the first FHE company valued at more than a billion dollars in June 2025, and in February 2026 Intel presented Heracles, an FHE accelerator it reports to be more than a thousand times faster than a 24-core Xeon processor on core FHE operations. But research published in late 2025 still measured encrypted inference through an 8-billion-parameter model in minutes per short prompt on eight top-end GPUs. Five years still looks about right, which is why the hybrid design stays the practical answer.

Ownership: your data is your business

Privacy is not only about who can read your data. It is also about who controls it. A personal AI that holds years of your life must let you:

• see what it remembers and correct it,
• export everything in a usable format,
• move to another service without starting from zero,
• delete everything, including backups and derived data such as embeddings and summaries.

In Europe, some of this is law. The GDPR gives you the right of access (Article 15), the right to erasure (Article 17) and the right to data portability (Article 20). But a right on paper only helps if the product is built to honour it. Local-first design honours it by default: if the primary copy is on your device, the company disappearing does not take your data with it.

Checklist: ten questions to ask any personal AI

Use these whether you are choosing an assistant or designing one.

1. Where is my data processed? On my device, in a confidential cloud or on ordinary servers?
2. Who holds the encryption keys? If the provider holds them, the provider can read the data.
3. Can the privacy claims be verified? Look for published software images, attestation and independent security research, not only a policy.
4. Are my conversations used for training? By default, or only if I opt in?
5. Are my conversations used for advertising or shared with partners?
6. How long is data kept, and what happens to deleted data? Including backups, logs and derived data.
7. What does memory store, and can I see and edit it?
8. What can the AI do on my behalf? Every connected account and agent permission widens what a mistake or an attack can reach.
9. Can I export everything and take it elsewhere?
10. What happens if the company is sold or closes?

If a service cannot answer the first three clearly, assume the provider can read what you tell it, and share accordingly.

Closing thought

I started this series by arguing that personal AI only reaches its potential when people dare to share, and that daring to share requires trust built on privacy and ownership. Nearly two years later the first half of that argument has played out: personal AI with memory is here. The second half is still being decided, product by product. The technology to do it right exists. What remains is to insist on it.

If you are building AI on sensitive data and want a second opinion on the architecture, write to me.

Frequently asked questions

What is a local-first personal AI? +

A local-first personal AI keeps the primary copy of your data on your own devices and runs as much as possible there. The cloud is used for synchronisation and for tasks the device cannot handle, ideally with end-to-end encryption and confidential computing so the provider never sees your data in readable form.

Can a personal AI work in the background without the provider seeing my data? +

Yes, with confidential computing. Background jobs run in a hardware enclave that receives encrypted data, decrypts it only inside the enclave and proves through attestation which code it runs. The provider operates the hardware but cannot read the memory.

What should I ask before trusting a personal AI with my data? +

Ask where your data is processed, who holds the encryption keys, whether conversations are used for training or advertising, how long data is kept, whether the privacy claims can be verified independently, and whether you can export and permanently delete everything.

Is fully homomorphic encryption ready for personal AI? +

Not for large language models. FHE is practical today for narrow tasks such as private lookups, but running a large model under FHE is still orders of magnitude too slow for an assistant. It remains the long-term goal because it removes the need to trust hardware.

Sources

1. Apple Intelligence Foundation Language Models tech report (July 2025): Apple's on-device model
2. Android Developers: ML Kit GenAI Prompt API (October 2025): Gemini Nano for Android apps
3. Daring Fireball: OpenAI gpt-oss (August 2025): gpt-oss-20b running in 16 GB of memory
4. Automerge 3.0 (July 2025): Ten times lower memory use
5. Automerge: July 2026 update: Keyhive end-to-end encryption and access control
6. tech.eu: Zama becomes the first FHE unicorn (June 2025): Zama's valuation
7. Tom's Hardware: Intel Heracles FHE accelerator (March 2026): Intel's FHE accelerator
8. Cerium: encrypted transformer inference on GPUs (arXiv, December 2025): FHE latency for Llama 3 8B
9. GDPR, Regulation (EU) 2016/679 (EUR-Lex): Rights of access, erasure and portability (Articles 15, 17 and 20)