Security

Private by architecture, not by promise.

This page explains exactly where your records live, what leaves your machine, and what never does — in plain English, so you can hand it to whoever asks you the hard questions.

Where your data lives

On hardware you own and control

Your archive is indexed and stored on hardware you own and control. There is no BePrivy cloud copy of your records — not a backup, not a cache, not a copy held for support purposes.

If you unplug the machine, your archive is unreachable — by anyone, including us. That is not a policy we could change later; it is a consequence of where the data sits.

Backups stay under the same roof. Copies are kept on hardware you control and restores are tested, so a failed drive costs you an afternoon rather than thirty years of records.

What never leaves your machine

The archive itself, and the index built from it

Full emails, documents, photographs, recordings, and the search index built from them all stay local. Many questions are answered entirely on the device, with nothing at all leaving the building.

Deletion means deletion. Remove something from Privy and it is gone from what Privy can read and answer with — it does not linger in a cache and resurface in an answer weeks later.

When you choose to use a cloud model

The question can travel. The details in it cannot.

Some questions can optionally use a cloud AI model for the final written answer. Before anything is sent, sensitive details are automatically protected in two tiers.

Handled locally
Everyday personal details — the ordinary names, places and figures that fill a normal life — are handled on your own machine.
Masked, then revealed on-device
Crown-jewel information — identity numbers, account details, designated private names — is masked before anything is sent, and can only be revealed on-device with the owner's fingerprint.
What you typed: “What did the accountant say about the studio deposit?”
What would actually leave: “What did [PERSON_2] say about the [AMOUNT_1] deposit?”

Fictional example, for illustration.

The mapping between a placeholder and the real thing it stands for never leaves your machine. You stay in control of what leaves.

Answers you can audit

Verification never requires trust

Every answer links the exact source documents it drew from — the real email, the real contract, the real photograph, with its date and where it came from. You can open them and check.

That is the difference between a system you believe and a system you can check. We would rather be checked.

What we do not do

No ads, no resale, no watching

  • No advertising. Nothing here is funded by showing you anything.
  • No data resale. Your information is not sold, licensed, shared with partners, or used to train anyone's model.
  • No tracking in the product. There is no analytics script watching what you ask.

Privy is in development. We are not claiming certifications we do not hold, and there is nothing on this page we would not repeat to your accountant.

Nothing leaves the building.

Request early access