algn - Architecture & Whitepapers Series
Private by Architecture - Whitepaper
On-device memory, zero-retention processing and a verifiable threat model for conversational AI.
Abstract
Privacy in conversational AI has mostly been treated as a policy problem: terms of service that promise protection, and settings that offer a sense of control over data that still sits on a company's servers. algn treats privacy as an architectural constraint instead. Persistent data, meaning memory and conversation history, is encrypted on the member's own device with a key that never leaves it. Each conversation turn is sent on from algn's servers with no account identifiers attached, answered by open-weight models running under zero data retention, and not stored. Matching in Us works in layers: sensitive topics stripped on the device, keywords the member approves, embedded and anonymised before anything leaves, and nothing shared unless the member chooses. This paper sets out the six layers, the threat model they answer, how each claim can be checked, and what the design costs.
Contents
Executive summary
Privacy in conversational AI has largely been a policy problem. Terms of service promise data protection, privacy settings offer a sense of control, and compliance frameworks provide legal cover. Underneath, the architecture of most systems is unchanged: what people say flows to central servers, persists, and becomes a corporate asset rather than personal property.[1]
algn treats privacy as an architectural constraint rather than a policy overlay. The aim is that the most personal data never reaches algn at all, and that whatever does pass through is anonymised, kept for no longer than it takes to answer, and handled only by servers that keep nothing.
Two facts carry most of the weight. First, persistent data (the memory vault and conversation history) is encrypted on the member’s device, under a key that is generated there and never leaves it. Second, inference runs on open-weight language models, reached through algn’s servers with no account identifiers attached, under zero data retention: nothing is kept, nothing is used for training and nobody reviews it.
What this paper claims
- Memory and conversation history are encrypted on the device, with a key algn never holds
- Each turn reaches the models as algn, with no account identifiers, and is not stored
- Inference runs on open-weight models under zero data retention
- Matching is layered: sensitive topics stripped, keywords approved, embedded and anonymised, then the member's choice
- Each layer is built as if the one outside it might fail
What this paper does not claim
- That any system is unbreakable
- That any single layer is enough on its own
- That words never leave the device: they must reach a model to be answered
- The exact assembly, providers or model names (withheld)
- That the trade-offs, such as no recovery, are costless
Where data lives
The simplest privacy question is where a member’s data is at any moment. In algn there are only three answers: on the member’s device, passing through to be answered, or held on algn’s servers because the platform cannot run without it.
The design principle follows from that picture. Data that never reaches algn cannot be sold, disclosed, breached or misused there. Data that only passes through should leave nothing behind. And the small amount algn must hold should be separated from identity wherever possible and deleted as soon as it has done its job.
Six layers
No single layer carries the weight alone. Each one is built as if the one outside it might fail.
Layers 1 and 2: on the device, encrypted
Everything Sera remembers about a member lives in a vault on their own device: who matters to them, the patterns Sera has noticed and every conversation thread. algn is a web app, and the vault sits in that device’s browser storage. None of it is kept on algn’s servers.
The vault is encrypted at rest with AES-256-GCM using the browser’s built-in Web Crypto. The key is created on the device, cannot be exported and never leaves it, so algn never holds it. There is no custom cryptography: only standard primitives that the browser already ships and that are tested in the open. Standard cryptography
Instead of a copy on algn’s servers, members keep a backup file locked with a passphrase only they know. The key is derived from the passphrase on the device (PBKDF2 with SHA-256) and the contents are sealed with AES-256-GCM. The file’s header carries only what is needed to decrypt it, with no user ID and no counts of what is inside, and the file is checked for integrity every time it is opened.
Layer 3: anonymised
Sera’s replies are written by models running on specialist servers. The member’s device never talks to them directly. Each request goes to algn’s servers first, which remove anything that identifies the account, keep the device and IP address from going further, and send the request on as algn, in the same stream as every other member’s. algn manages usage limits itself, so the model servers never need to know who is asking or how often. Each request carries only the latest turn, the recent conversation and the slice of memory that reply needs, never the whole vault. Architectural
Layer 4: nothing kept
Anonymising a request is one layer; making sure nothing survives it is the next. Each request is held only while it is being answered, and it is not stored or logged. Every model and speech server that handles a member’s words or voice works under zero data retention, with no training on the data and no human review of it. The language models are open-weight. Background processes (reading tone and pacing, drawing out memories, reasoning about patterns, and the safety check) follow exactly the same rules. When a new memory is drawn out, it is sent back to the device and written into the vault, and algn keeps no copy. Contractual + architectural
Voice gets the same treatment. Speech is streamed to transcription servers and turned into words in real time, and Sera’s voice streams back from voice-synthesis servers. Audio leaves the device to be heard, but it is not recorded or stored, by algn or by any server it passes through.
Layer 5: stripped and salted
Matching in Us, algn’s social platform, is where most social products learn the most about their users. It is designed to learn as little as possible, and it does that in layers, five of them on the device before anything leaves it:
- Sensitive topics stripped. Health, sexuality, trauma and other sensitive topics are removed and can never be matched on. When the system is unsure, a topic stays out.
- The member approves. The member sees the exact keywords that would leave the device, and can untick any of them or a whole topic.
- Keywords, never sentences. What remains is reduced to keywords. The member’s words stay on the device.
- Embedded on the device. The keywords are turned into numbers, an embedding, on the device itself.
- Anonymised. Before anything is stored, the numbers are salted with a secret key, so they are tied to algn’s matching system rather than to the public models that made them.
On algn’s servers, matching data is a set of anonymised numbers, a topic category and a tone score, with no words and no name. It is used for a matching run and then deleted, and members can pause matching or delete their matching data whenever they choose. The final gate is the member’s own choice (Layer 6).
No single layer carries the weight. Stripping keeps the most personal parts of a life from ever becoming numbers, approval keeps the rest in the member’s hands, and reduction, anonymisation and deletion keep what does leave small and short-lived.
Layer 6: the member’s choice
The last layer is not technology. Nothing about a member crosses to another member unless they choose to send it. When there is a proposed match, the member decides whether to send a voice note or a text message. The other person is never shown why they matched; they see only what the member chose to send, and decide whether to accept it, not accept it or block. Both stay masked, with no name and no photo, until both choose to unmask.
Messages and voice notes between members are end-to-end encrypted: content is sealed with AES-256-GCM, keys are exchanged with RSA-OAEP, and private keys stay on members’ devices. algn’s servers hold messages only as ciphertext, long enough to deliver them.
Threat model
Layers are only worth something if they hold on a bad day. The table sets out what each scenario would find.
| Scenario | What it would find | What it would not find |
|---|---|---|
| algn’s servers are breached | Account data, membership and credits, short-lived anonymised matching numbers, messages as ciphertext | Memory, conversation history, audio, messaging keys |
| algn receives a legal demand | The same server-side data, and only that | Anything held only on the device |
| A model or speech provider is breached | Nothing retained under zero data retention | Anything tied to a member’s account |
| A device is stolen | An encrypted vault behind a passkey or device biometrics | A readable vault, even on an unlocked phone |
| A member loses the device and the passphrase | Nothing, because only the member could ever open it | Any way for algn to restore it |
The model has limits that the table does not hide. Words have to reach a language model to be answered, so the privacy of a turn in transit rests on encryption, anonymisation and the providers’ zero-retention terms rather than on the content never leaving the device. Zero data retention is a contractual commitment from each provider, checked by algn, not something a member can inspect directly. And an attacker with control of a member’s unlocked device and passkey has what the member has.
Verification
The model is designed to be checked rather than taken on trust.
- The backup: the app’s inspect view shows the raw file, its header, size, fingerprint and ciphertext.
- The memory: members can open the vault, read every memory, and edit or delete any of it.
- The matching: members see the keywords that would leave the device, can untick them, pause matching and delete their matching data.
- The code: the parts that hold the vault, manage its keys and delete data are published as an open repository, with a data-flow manifest listing every process, the data it receives, the kind of server it goes to and how long anything is kept.
- The providers: a sub-processors list names every company whose servers algn uses and their retention terms.
Honest trade-offs
Every layer costs something, and the costs fall partly on members.
- No automatic cloud sync. Memory never sits on algn’s servers, so members carry it themselves in their encrypted backup.
- No recovery from algn. A lost device and a forgotten passphrase mean the memory is gone, because algn never had it.
- Nobody reading along. No person watches conversations, not even to help. A safety check runs on each conversation, and no one sees what was said.
- Less to match on. Whole parts of life are kept out of matching. That is what makes it safe to be matched at all.
- Powerful models, reached anonymously. algn uses capable open-weight models on specialist servers, reached as algn and under zero data retention, rather than weaker models it could run itself. Local models will be revisited as their quality and speed improve.
Conclusion
Privacy at algn is meant to be a property of the system rather than a promise about behaviour. The most personal data, memory and conversation history, is encrypted on the member’s device and never held by algn. What must travel to be answered goes as algn, is handled by open-weight models under zero data retention, and is not kept. What is used for matching is stripped, approved, reduced and salted before it leaves. None of these layers is perfect on its own, and this paper does not claim otherwise. Together they mean that the data breaches target and legal demands seek is, for the most part, not there to find.
References
- 1.Zuboff, S. (2019). The Age of Surveillance Capitalism. PublicAffairs.
Open review
This is a living document. Our thinking is still developing and some of it will turn out to be wrong. If a claim looks off or a source doesn't hold up, tell us below.