Don't let your app promise more privacy than your config delivers
How Everblue decides what it's allowed to say about AI and your data.
"We never store your data." "Your entries are never used to train AI." Plenty of AI apps print lines like these, and the engineers often couldn't tell you whether they're true. The answer usually lives in a provider dashboard, not in the codebase.
Everblue is an AI journaling app. People write about their lives in it, so I treated the privacy copy as a technical claim that has to be backed by something.
Start with what can stay on the device
The journal is stored on the phone. Retrieval runs there too: MiniLM embeddings through ONNX, keyword search (BM25) and recency decay in SQLite. The index and the embeddings never leave the device. The companion has also run entirely on Apple's on-device Foundation Models. Anything you can keep local, you never have to make promises about.
Then be exact about what leaves
Chat messages, entries the user shares with the companion, and photos they add do go to model providers, routed through OpenRouter. Before anything goes out:
- photos pass an on-device sensitive-content check, then get downscaled and EXIF-stripped;
- the backend passes requests along and doesn't keep them, with no prompt or image logging above debug level.
In the first version, PII was redacted before every prompt, and payloads went only to Gemini's paid tier, which doesn't train on them, with retention opted out per request.
Zero data retention is a setting, so model it as one
Whether a provider retains prompts depends on account-level routing: prompt logging off, and zero-data-retention endpoints only. My code can't enforce that, so it doesn't pretend to. A single flag asserts that ZDR routing is on, and it stays off until the routing has been verified in the dashboard. A /api/privacy/ endpoint reports the current posture, so the app can show copy that matches reality, and if that request fails it falls back to the more cautious wording.
Write down what you can never claim
The ops doc has a list: no "never used to train AI" and no "not stored by the provider" until the settings back it up, and never that a provider can't review a request flagged for abuse. Having that list in the repo means a future copy change has to get past it.
Takeaways
- Keep whatever you can on the device. It's the only privacy promise you fully control.
- List exactly what leaves the device, and strip metadata before it goes.
- Treat zero data retention as provider configuration, behind a flag you only turn on after checking.
- Let the app's privacy copy read the real posture from the backend, and fail toward the cautious wording.
- Keep a "never claim" list next to the code.
I'm looking for an AI engineering role (remote, US). If your users trust you with personal data, I'd love to talk.