Product · August 25, 2026

The Wall Between Your Pocket and Your Desk

We could ship an assistant that reads your Messages, on-device, without a byte leaving your Mac, and we have decided not to. The reason is a boundary that the last twenty years quietly dissolved.

The feature we didn't build

A few days ago a plugin appeared that points a cloud AI at your text messages, and it drew widespread alarm online. We wrote about the mechanism separately. The vulnerability lay in the endpoint rather than in the encryption, which never broke, because your Mac keeps your decrypted conversations in a plain database called ~/Library/Messages/chat.db, and the plugin forwards what it reads to someone else's servers.

That critique is easy for us to make, because we run our models the other way: Privt Voice does its thinking on your Mac. That is exactly why the harder question landed on our own desk almost immediately. We could read chat.db too, summarize your threads, let you ask questions across years of them, and say, truthfully, that not one message ever leaves your machine. On-device work is the whole of our posture, so building this would have been squarely on brand and, technically, the work of a weekend.

We spent real time on it, and the answer, for now, is no. What a privacy tool declines to build is as much a product decision as what it ships, so here is the honest reasoning.

Two operating systems, one wall

Twenty years ago the computer in your pocket and the computer on your desk were different worlds, with different processors, different software, different data, and a natural gap between them. Your desktop could not casually read the texts on your phone, because they lived on another device with another threat model. No one ever wrote that boundary down as policy; it was a matter of physics and a little inconvenience, and it did a quiet, important job.

Then the two operating systems merged, through Handoff, Universal Clipboard, iCloud, Messages in the Cloud, and one account spanning every device you own. Each step was a real convenience, and we used every one of them, yet collectively they dissolved the wall. Today the most intimate record you keep, the conversations that are protected end-to-end the moment they cross the network, sits decrypted as an ordinary file on the same desk where you install everything else.

That is the part worth sitting with. Beyond letting your devices talk to each other, the merge moved your pocket's secrets onto your desk, where they wait in the clear, one permission prompt away from any program you run.

What looks like friction to be optimized away is the wall doing its job.

Compartmentalization is a security principle

Nearly everything that works in security is a form of the same idea, whether it goes by least privilege, sandboxing, need-to-know, air gaps, or separate accounts for separate jobs. Every one of them is a compartment: a wall placed so that a problem over here does not become a catastrophe over there. The discipline is less about building higher outer fences than about making sure that when something gets in, it does not get everything.

A single, seamless operating system that spans your whole life runs against that grain by design. It optimizes for a surface where everything can reach everything, which is delightful right up until it becomes the reason one careless tap hands an app your texts, your mail, and your backups at once. When we sketched Messages reading, we realized we would be treating that collapsed boundary as an opportunity, becoming one more program leaning on a wall that is already too low and presenting the result as a feature.

Three things that being on-device does not fix

Keeping the model local is necessary but not sufficient. Three problems survive it, and they are the ones that stopped us.

The permission is the whole house. To read chat.db an app needs Full Disk Access, the broadest grant macOS offers. There is no narrow "just Messages" version of it. The same switch that would let us read your texts also exposes Mail, Safari's data, and your Time Machine backups to us. A company whose entire promise is that it cannot see your data, asking you to open every door in the house, is a contradiction we are not willing to smooth over with a reassuring sentence.

The other person never agreed. Half of every conversation you keep was written by someone else, inside a promise that only the two of you would ever read it. Processing it on your Mac keeps that plaintext from leaving, which matters enormously, yet it still leaves the other side of the thread as something an AI was never invited to read. On-device processing shrinks the harm while doing nothing to obtain the other person's consent.

Reading becomes a habit rather than an event. A person could always screenshot a single thread. What changes when software does it at scale is permanence and reach: your entire history becomes queryable, retroactively, forever. Removing the cloud removes the third party who would hold that index, but it leaves in place the habit we would be quietly installing into your most private channel.

What would have to be true

We are refusing to build it in this way and at this moment, while leaving the future open. If we ever build intelligence over Messages, the bar is fixed in advance, and in public:

Even then it would arrive only because you asked us for it, never as a banner we pushed. That last requirement is the real gate. Apple's own on-device intelligence already summarizes your Messages, for free, without a third app in the room, and we have no interest in reinventing that while taking on the liability of the master key to do it.

The calm version

The convenient story is that the wall between your pocket and your desk was always just friction, and good software removes friction. The truer story is that the wall was doing a job, and the industry spent twenty years removing it without asking what it protected.

We build in the other direction: Privt Voice keeps its model, your transcripts, and your keys on the one machine that already holds them, and it does not cut a new door into your private life just because the door would be easy to cut. Sometimes the most useful thing a privacy company can do for you is tell you, plainly, about the feature it chose not to build.

← All posts