A privacy promise is only as good as the person making it. We did not want to ask you to trust a promise. We wanted to build something where the answer is structural.
The space is yours
Your companion and everything it knows live in a space that only you can open. There is no back door, no support login that reads your history, no quiet override. When we say we cannot see it, we mean the design does not let us.
You can bring your own hardware
If you would rather not rely on anyone else at all, you can run your companion on your own machine. It joins your private space, and the shared compute drops to nothing while it is on.
Privacy that you can reason about beats privacy you have to take on faith.