Not every thought needs an audience.
A private journal with an AI that can’t read your secrets — and a receipt on Solana for every time anything touches them.
- plaintext we hold
- 0
- plaintext we hold
- per on-chain receipt
- 212 B
- per on-chain receipt
- to unlock
- 0.4 s
- to unlock
Tonight, 1:12 am
- slot
- 318,402,117
- hash
- 9f3a…c21e
- content
- none
The problem
Most apps keep your words readable. We don’t.
The same sentence, through two designs. One ends in a database and a training set. The other ends as noise, plus a public receipt.
A typical AI app
- You type“I can’t sleep”
- Their server“I can’t sleep”
- Their database“I can’t sleep”
- Training set“I can’t sleep”
Readable by engineers, logs, backups — and the model.
UNSAID
- You type“I can’t sleep”
- Sealed on phonex9Kq…Zt_4
- Our serverx9Kq…Zt_4
- Solanareceipt · no content
Readable only on your phone. Provable by anyone.
How it works
Privacy you can check, not just trust.
- Step 01
Sealed on your phone
Every word is encrypted on your device with AES-256-GCM before it leaves. We only ever receive noise.
- Step 02
Reflected on in a sealed chip
Ask Echo for a reflection and it runs inside a hardware enclave that signs what code it ran.
- Step 03
Receipted on Solana
Each access writes a 212-byte, content-free receipt to a public ledger nobody can quietly edit.
Echo · private AI
An AI that reflects — and can’t leak.
A model cannot reflect on words it cannot read, so the one memory you choose is read inside a sealed chip that signs what code it ran. The reply comes back to your phone and is sealed again; a receipt lands on Solana. Five steps, on a loop:
- 1. You askYou tap Reflect on one memory and confirm the disclosure (v1).
- 2. Opened on your phoneThat one memory is decrypted on your device and sent over TLS. Our API relays it and writes nothing down.
- 3. Read inside a sealed chipThe model runs in an Intel TDX + NVIDIA confidential enclave. The hardware signs which code was loaded.
- 4. Back, and sealed againThe reply returns to your phone and is encrypted there before it is stored. We keep only ciphertext.
- 5. A receipt anyone can checkA content-free receipt lands on Solana: consent version, enclave measurement, reply hash, time.
On-chain · Solana
Every access leaves a receipt. None of them hold a word.
An Anchor program on Solana records who accessed a memory, under which consent, in which enclave, and a hash of the reply — never the memory itself. It is the one record we cannot edit after the fact, which is exactly why it is there.
Program id · devnet
7nRKgRMiHfXg3fUXPRFdNX97BWfSKhNqvBaXZM5BLcHZ
UNSAID consent ledger
7nRKgRMiHfXg3fUXPRFdNX97BWfSKhNqvBaXZM5BLcHZ
212 B
per receipt
0 B
of content
~1.1 s
to confirm
| Signature | Purpose | Enclave | Slot | Age |
|---|---|---|---|---|
| 4xQm…8KpL | Reflection | Attested | 318,402,117 | 12s |
| 2bTr…Vn9e | Anchor | Not needed | 318,401,980 | 1m |
| 5hCw…Qz3a | Reflection | Attested | 318,398,544 | 24m |
| 3kLp…Ye7d | Export | Not needed | 318,390,021 | 1h |
Example receipts, in the exact shape the program stores. No row holds a word of content.
Our research
Private, and still fast. We measured.
Every figure comes from a script in our repository, run on a 2015 laptop on purpose.
The privacy invariant
- Whole database244 KB pg_dump, every table0found
- Object storage806 objects, 46 KB0found
- API logs34 KB of captured output0found
backend/api/scripts/canary-sweep.ts. A control decrypts memory 1 and asserts the marker is there, so an empty search cannot pass by accident.
Where the time goes
171 ms
full save, median · p95 203 ms
Client seals → ciphertext to object storage → metadata to the API. n=30, median, local infrastructure.
Encryption cost
AES-GCM-256 per memory, key wrapped with AES-KW. Median of 20 runs (5 at ≥1 MB). 2015 laptop.
On Solana
- Receipt size
- 212 B
- Of a transaction
- 17.2%
Devnet, written one at a time. Both failures were the free public endpoint's WebSocket dropping, not the program rejecting anything.
Unit economics
Todaymeasured
Batchedprojected
Per user per month, by reflections per month, against an $8 plan (axis top). Today: one rent-exempt account per receipt at $73.85/SOL (22 Jun 2026 quote). Batched: one Merkle root per period, ~20× cheaper — not yet built.
Prior art
Consumer AI chatbots
- Encrypted storage—No
- Attested AI—No
- Public per-access receipt—No
End-to-end encrypted note apps
- Encrypted storageYes
- Attested AI—No
- Public per-access receipt—No
Confidential-cloud AI (e.g. Apple PCC)
- Encrypted storage—No
- Attested AIYes
- Public per-access receipt—No
UNSAID
- Encrypted storageYes
- Attested AIYes
- Public per-access receiptYes
| Approach | Encrypted storage | Attested AI | Public per-access receipt |
|---|---|---|---|
| Consumer AI chatbots | —No | —No | —No |
| End-to-end encrypted note apps | Yes | —No | —No |
| Confidential-cloud AI (e.g. Apple PCC) | —No | Yes | —No |
| UNSAID | Yes | Yes | Yes |
Our contribution, from docs/paper/research-notes.md: binding attestation, consent version and a content-free receipt — per access, on a public ledger — over end-to-end encrypted personal data.
Try it
Don’t take our word for it.
This runs the product’s real encryption in your browser, on your sentence, and shows exactly what we would receive.
Try it right here
Write something. Watch it become unreadable.
This runs the product’s actual encryption in your browser, on your words. Nothing is sent anywhere — there is no network request on this page.
Full disclosure
Exactly what we can see
Both columns are complete. The left one is short because there is genuinely nothing else in it.
What we can see
The complete list. There is nothing below this.
The date you saved something
A timestamp, to sort your vault
Whether it was voice or text
To know which player to show
How large the encrypted file is
To bill storage and spot abuse
That an access happened
Written to the public consent ledger
What we cannot
Not by policy — we built it so that we are unable to.
What you wrote or said
Encrypted before it leaves your device
A title, summary or transcript
No such column exists in our database
Your mood, tags or categories
The product never asks you for them
Anything after you forget it
The key is destroyed first, so the bytes are noise
Features
Everything a private journal should be
Speak or write, immediately
One tap to talk, one to write. No title, no tags, nothing to fill in before you have said anything.
A reflection, not a lecture
Echo responds to one memory at a time, only when you ask, and only after you have read what that means.
Your phrase is the only key
Unlocking takes about four tenths of a second. We cannot reset it, because we never had it.
Leave with everything
One button exports every word, decrypted, as ordinary files that open without us on any computer.
Forget for real
Forgetting destroys the key first, so even a surviving backup is unreadable noise — including to us.
Audit every access
An access log with the matching on-chain receipt beside each entry, so our story can be checked.
Our promises
What we will not do
- Read what you write. We built it so that we cannot.
- Sell your data, or use it to target anything at you.
- Train models on your memories.
- Give you a follower count, a streak, or a reason to perform.
- Pretend to be therapy. UNSAID is not a clinical service.
Editor’s note · The honest caveat
Nothing is unbreakable
A device that is already compromised can read what you type before we ever encrypt it, and we do not promise anonymity from someone with access to your device or network. What we promise is narrower and testable: a leak of our database or storage does not expose what you wrote. Lose your phrase and your recovery kit, and your memories stay locked — including from us.
Read exactly how this worksQuestions
Asked, and answered plainly.
Can UNSAID read what I write?
No. Every memory is encrypted on your device with a key derived from your phrase before it is sent. We store ciphertext and a timestamp. Our own leak test searched the whole database, every stored file and every log for 30 planted secrets and found none.
Then how can the AI reflect on it?
Only when you ask, for one memory at a time. That memory is opened on your phone and read inside a hardware enclave (Intel TDX with NVIDIA confidential computing) that signs which code ran. Nobody outside the chip — including us — sees it, and the signature goes on the receipt.
What exactly goes on the blockchain?
A 212-byte consent receipt: which memory (as a hash), the consent version you agreed to, the enclave measurement, a hash of the reply, and the time. Never your words, your voice, or your identity. A stranger can verify any receipt at /verify without our servers.
Do I need a crypto wallet?
No. Everything works without one. A wallet is only needed if you want to anchor a memory under your own key as proof it existed and is yours.
What if I forget my phrase?
Your recovery kit — shown once when you create a vault — lets you set a new phrase. If you lose both, the vault stays locked forever. That is the price of nobody else holding a key.
Is this therapy?
No. UNSAID is a private place to write and reflect. It is not a clinical service and cannot assess how you are. If you are in danger, contact local emergency services.
Early access
Thirty people first.
We would rather get it right for thirty people than be adequate for thousands.