Local by default. External only when you choose.

This page is our promise, in plain words. The full technical detail sits underneath, for anyone who wants to verify it.

It stays in your house by default

Your questions, files, and history live in the box on your shelf, and nothing goes out unless you send it. There's no account in the cloud holding your life.

Nothing is collected

No ads, no profiles, no selling your information. There's nothing to opt out of, because nothing is being gathered for anyone else.

You hold the keys

You decide what it connects to. What it remembers. What gets backed up. All from the app on your phone.

When something does go out

Sometimes you'll want help from the big-name AI services for a hard task. That's your call. You make it per request, under your own account. Local workflows run on your appliance. When you choose an external model or connected service, the request and context required for that workflow may be transmitted to that provider under its terms and your account settings. Your assistant tells you before anything leaves the house, and everyday work keeps running even with the internet down.

If a unit ever comes back under warranty

Returned units are wiped completely as part of processing. Keep your own backup of anything you want — your assistant can copy everything to your own drive whenever you like.

For technical readers — the full detail

It works at home by default. Your assistant runs on hardware you own. Your conversations and documents stay on the device by default — this page explains exactly what that means, and exactly when data can leave.

What stays on the box itself by default

Upstream framework usage reporting is disabled in the Digital Twin Pro production image. Digital Twin Pro does not transmit prompts, files, conversations, model inputs, or agent memory for product analytics. This is verified during golden-image validation before units ship.

  • Your conversations with your assistant using local models
  • Documents, notes, and files you load onto the appliance
  • The assistant's memory and preferences
  • Local voice processing, where configured

What leaves the device — only with your approval

  • Bring-your-own-key providers — if you connect Claude, GPT, Gemini, or another provider, the prompts you route to them are processed under that provider's terms. You choose when.
  • Messaging connections — messages you exchange through connected apps pass through those platforms, as they normally would.
  • Encrypted backups — Your data stays on the appliance; you can copy backups to your own drive whenever you like, and a one-time service can set that up with you.
  • Life Upload — approved documents you send before shipment are processed privately, loaded onto your appliance, and then removed from our systems, with a written scope and deletion confirmation.
  • Large private jobs — approved oversized jobs can be processed privately and returned to your appliance.

Deletion and ownership

The appliance is yours. Delete conversations and documents at any time from your dashboard; a factory reset removes all stored content. If a unit ever comes back under a warranty claim, we wipe the hardware as part of processing.

What we do not do

  • We do not sell your data.
  • We do not train shared models on your private content.
  • We do not connect your appliance to outside services without your action.

Remote access and remote operations

Remote access is not enabled for Digital Twin Pro personnel by default. When an owner purchases or requests an authorized support or fleet-management service, access may be provided through an approved method such as Tailscale SSH or a managed device connection. Access is limited to the approved scope, identity, device, purpose, and time window, and it ends when the approved work is done. The owner can revoke access at any time according to the documented procedure for their engagement.

Remote sessions may expose the system configuration, logs, and process output necessary for the approved work; they do not include unrestricted access to private content unless the written scope explicitly requires it. Where the access method supports it, sessions are logged. Managed device deployments, when used, install, update, or replace only approved software components, and Digital Twin Pro records deployment versions, authorized operators, timestamps, and outcomes. The specific access method, logging, and revocation procedure for each engagement are documented in its written scope. See Owner-Authorized Remote Operations and Fleet Management for Businesses.

Choose the right private AI system

One system, one payment, the first three months of Managed Private AI included free. Current pricing on each product page.

Compare Private AI Systems

The Managed Private AI access boundary

Managed Private AI does not give Digital Twin Pro unrestricted access to private content. Access is scoped, owner-authorized, logged where supported, limited to the approved task, and revocable.

If you choose Managed Private AI, here is exactly what that access means:

  • What we can reach: system software, model versions, service health, and the settings you have asked us to tune.
  • What we cannot reach: your documents, chats, and history are not part of a routine management session. If a fix ever needs us to see your content, we ask first, in writing, for that one task.
  • When: only in scheduled windows you approve, or when you invite us in for a specific problem.
  • How you see it: support access is visible on your box while it is on, and every session is logged with what was done.
  • How it ends: you can revoke access with one switch at any time, and ending the plan removes our access entirely. The box, your files, and your history stay exactly as they are.