Privacy changes what we are able to say
There is a difference between writing something for an audience and writing it only to understand it yourself. In the first case, we edit the thought while it is still forming. We make it sound reasonable, remove contradictions, and hide uncertainty. In the second, we can begin with the unfinished version: “I do not know why this bothers me,” “I may have changed my mind,” or simply “Something feels wrong.”
That unfinished material is often the most valuable part of a journal. It is also the most sensitive. If every entry feels like a message being sent to an unknown system, the conversation changes before it begins. Privacy is therefore not only about protecting stored data. It directly affects whether a person can speak freely enough for reflection to be useful.
We want Narratives to feel less like sending pieces of your inner life somewhere else and more like opening a private space on a device you already own.
Local by default
The central AI model in Narratives runs on the iPhone. A normal conversation does not need to travel to a developer-operated AI server in order to receive an answer. The same local-first approach applies to the context that lets the dialogue continue, as well as to core processing for voice notes and images.
This is a product decision, not a privacy label attached after the fact. Building for local inference affects the models we can use, the way context is assembled, how memory is managed, and how the app responds when the phone is under pressure. It asks us to work within the real limits of a personal device instead of silently moving the difficult work to the cloud.
Local processing also means that the core experience remains available without a stable connection. A thought can arrive on a train, during a walk, or late at night when the network is unreliable. The journal should still be there.
No account as a design choice
Narratives does not require an account before you can begin. There is no profile to complete and no personal cloud identity that must be created simply to write a first sentence. Removing registration is not only about shortening onboarding. It avoids turning a private journal into an account relationship by default.
An account is useful when a service needs to recognize someone across servers and devices. But it also creates another store of identifiers, access credentials, recovery flows, and behavioral history. For a local personal space, the better starting point is different: open the app, begin the conversation, and let the data stay with the device.
This does not make the phone magically invulnerable. Device security, backups, passcodes, and physical access still matter. It does, however, reduce the number of places involved in an ordinary journal entry and makes the privacy boundary easier to understand.
A journal needs memory, but memory needs limits
A useful conversation cannot start from zero every time. Narratives may need to remember that you are working on a particular project, that a certain routine did not fit you, or that an unresolved question should be continued later. Without context, a personal assistant becomes a stranger at the start of every exchange.
But remembering everything indiscriminately is not the answer. Good memory is selective and legible. It should preserve what helps the dialogue continue—your goals, decisions, corrections, constraints, and open questions—without treating every sentence as a permanent fact about you.
That is why memory in Narratives is something the user can review and clear. The assistant should not become an invisible biography that is impossible to inspect. Context is useful only while it remains under the control of the person whose life it describes.
What stays on the device
The ordinary material of Narratives—dialogues, stored context, tracker entries, schedules, and reflections—is designed to live locally. Voice transcription and image understanding are also built around on-device processing. The goal is for the most personal parts of the experience to remain inside the same privacy boundary.
This matters because privacy can be lost through small fragments as easily as through complete diaries. A transcription may reveal where someone was and what they were worried about. A photo may contain a room, a document, or a moment that was never meant for a remote archive. Context can be more revealing than a single message. Keeping these pieces together on the device avoids creating an external copy simply because AI was involved.
Local storage also keeps the relationship understandable: your journal is not a collection of entries scattered across several opaque services. It is an application and its data on your iPhone.
You can create trackers for your own observations; their settings and entries are stored locally, alongside the rest of your personal history in the app.
When the internet is actually needed
Some questions are inherently about the outside world. A current weather forecast, a web search, or the contents of a page cannot be answered from a local model alone. In those cases, an online tool can be used for the specific request that needs it.
The important distinction is between a local conversation and an explicit external lookup. Narratives should not quietly turn every personal message into a server request. Connecting to an online source should have a clear purpose, and the result should return to the conversation as supporting information rather than changing the default privacy model of the journal.
This boundary also helps the assistant stay honest. Local reasoning, personal context, and current facts from an external source are different kinds of information. Treating them differently makes it easier to understand what the answer is based on.
Control matters more than promises
Privacy statements are easy to write. Meaningful control has to exist in the product. A person should be able to see what the journal remembers, remove local content, and decide when to export a backup. Leaving should not require negotiating with a remote account or wondering which copy of a conversation remains somewhere else.
The same principle applies to new features. A convenient function is not automatically worth expanding the privacy boundary. Each capability has to answer basic questions: Does this need the internet? What information leaves the device? Is the action visible to the user? Can the same value be delivered locally?
There will always be tradeoffs. A phone has less memory and energy than a data center. A local model may answer more slowly or know less about recent events. We prefer to make those limits visible and improve within them rather than hide the true cost of convenience.
A place that belongs to you
Narratives is being built for thoughts that do not yet have a final form. That requires a different foundation from products designed primarily for publishing, sharing, or collecting user activity. The journal must be useful before it is connected to anything else.
Our principle is simple: local first, no account by default, explicit online tools when they are genuinely needed, and memory that remains visible and controllable. Privacy is not the final screen in settings. It is the condition that allows the first honest sentence to be written.