How private AI works on Peachy

An AI messenger usually means handing your conversations to whoever built it. Not here: your private chats are end-to-end encrypted and no AI of ours can read them, and what it does read, it reads inside a machine whose code you can check yourself.

Every model call runs inside an attested enclave

Every model call Peachy makes — every feature, every account, every time — goes to an open-weight model inside a confidential-computing enclave operated by Tinfoil. The hardware signs a statement naming exactly which code is loaded, and each release’s is published to a public transparency log. Our server checks it before the first request and hourly after, and pins the connection to the key it names.

No second provider, and nothing to fall back to

There is no other model provider and no per-account rollout sending traffic elsewhere. If the enclave cannot be verified, the requests bound for it fail rather than going somewhere we could not show you: a notification that might have been held back buzzes instead, an assistant turn reports itself unavailable.

Two enclaves, and you can check both

The model is Tinfoil’s code. The worker that reads a conversation, decides what to ask and writes the answer is ours, and runs in an attested enclave of its own. Verify shows what our server found for each and runs the same check in your browser. Read a green result as strong evidence rather than proof — the checker is code we served you. In the iPhone and Mac apps it is compiled into a build Apple signed, which is stronger; Android shows our server’s verdict.

What Peachy can and cannot see

Peachy is scoped to your own content — the chats, posts and people you can open yourself. It cannot read an encrypted conversation at all: every query that builds a prompt leaves sealed messages out, so a private chat is invisible to the assistant, to your feed and to the thing deciding whether your phone buzzes. Nothing reaches another person without your tap, and your goals live in your chat with Peachy, not in a settings screen.

What we are not claiming

Our ordinary servers are not an enclave, and hold the readable side of Peachy: Slices, the commons, public rooms and your chat with Peachy itself. The prompts behind notification triage and tagging are built inside the enclave now, from message ids and none of the words; the feed and chat lenses are not yet, and read the text. An attested enclave is a fact about a machine, not a promise from us — and not a second encryption claim.

How your messages are encrypted, what we hold, and what a finding pays. Get started.