Private by design
A privacy-first app shouldn’t rely on a promise not to look. Here’s how Maarij makes the guarantee structural — and exactly where it stops.
People search things in a religious app that they would not say out loud: doubt, guilt, grief, questions they’re embarrassed to ask a person. The right way to honour that isn’t a privacy policy promising we won’t look. It’s building the app so that what you search never reaches us in the first place. That’s what “private by design” means here, and I want to be precise about exactly how far it goes.
What “local” actually means
The entire search path runs on your device. The index lives on the client, the embedding model runs in your browser, and the nearest-neighbour search is a direct calculation over the vectors, right there on the device. Your question is turned into a vector and compared against the corpus locally. At no point does the text you typed travel to a server to be searched, because the search doesn’t happen on a server.
The one thing that leaves, and only with consent
I won’t overclaim, because a privacy claim that isn’t exact is just marketing. Retrieval is fully on-device and, by default, the app is retrieval-only — it finds and shows you the evidence, and nothing leaves. The single exception is if you ask for an AI-written answer. Then, with your consent, your question and the retrieved public-domain texts are sent to a generation endpoint to compose the reply. That step is opt-in, it’s the only thing that crosses the line, and what crosses is your question plus already-public source texts, not a profile, not history.
We deliberately did not push generation fully on-device too. On religious content, a small local model that hallucinates a ruling is a worse failure than a network call, so that one step stays server-assisted and consented, on purpose.
It falls out of the architecture
The thing I’m most pleased with is that none of this is a privacy feature we bolted on. It’s a consequence of three earlier decisions: a domain-blind core, an index small enough to ship to the device, and a model that runs in the browser. Once the whole search path is local, private-by-default isn’t something you add and police, it’s simply what the system already is. The architecture makes the guarantee for you.
Why this is the guarantee worth having
A promise not to look depends on us keeping it, forever, including after an acquisition, a subpoena, or a bad quarter. A design where the question never leaves the device doesn’t depend on our good behaviour — there’s nothing to hand over because nothing arrived. For this kind of content, that’s the only guarantee I’d actually trust if I were the user. The strongest privacy guarantee is the one you couldn’t break if you wanted to.