The question you would never send to a server
The things you would most want to ask an AI are the things you would never want on someone else's server. That sentence, from Ebenezer Don's Product Hunt launch post, is the whole origin story of CuriousLM: ask it why you keep apologising in emails, paste in the message from your sister, let it read your calendar. It all stays on your device, encrypted.
So Don built an AI that does not have a server. CuriousLM runs the model on your own phone or laptop. There is no account, nothing to sign up for, and it keeps working in airplane mode. “I'm Ebenezer, and this is the AI I wanted for myself,” he wrote at launch. The product launched on Product Hunt on 2 November 2026, and it arrived at a moment when the question people were asking about chatbots had sharpened: not just “is my chat private?” but “where does my chat actually go?” CuriousLM answers that question with a clear boundary — nowhere. Your prompts and responses never go to a CuriousLM inference server.
That boundary is the product. Everything else — the features, the interface, the writing about it — exists to make the boundary inspectable rather than merely claimed.
Heat: uncertainty you can see
CuriousLM's signature idea is one most AI products would hide: uncertainty. Words arrive hot and cool to ink, and the ones the model was unsure of stay underlined. Tap one to see what else it nearly said, and take the answer another way.
It is a small interaction with a large philosophy behind it. Most chatbots hide doubt behind fluent text; CuriousLM shows you where it hesitated, so you can steer instead of trusting. The same instinct runs through the rest of the app. Voice input and output run on the device too, so you can talk to it without sending audio to a server. Pocket Wikipedia is a pocket-sized reference shelf: the 121,797 most-read Wikipedia articles fit into just 60 MB on your device, so factual questions can still get sourced answers offline — rare for a fully local app.
There is also a journal, where you can write thoughts and daily entries and have the AI help you reflect on them, without your journal ever leaving your phone. Projects keep related chats together, memories store small facts you choose to save, and imported files are indexed locally so you can query your own documents without uploading them. On Android, with your permission granted source by source, it can even speak first: reading notifications and your calendar to tell you who is waiting on a reply and what is due.
Local storage is not local inference
Months before the Product Hunt launch, Don wrote the essay that explains why CuriousLM is built the way it is. Building it, he wrote, forced him to turn a broad promise — “local AI” — into a list of specific technical decisions. The useful question was never simply “is this app private?” but smaller ones: where does inference run, where are conversations stored, which actions need the internet, what leaves the device when they do, and what does the user see before anything is sent?
The first distinction is the one most products blur. An app can save chat history in the browser while still sending every prompt to a hosted model API. In that setup, storage is local but inference is remote. For normal CuriousLM chat, the model runs on the user's device, and chats, projects, memories, imported files, retrieval indexes and model artifacts are stored there too. “Your history is stored locally” would be an incomplete description, Don wrote; a useful privacy statement has to explain both computation and storage.
The second distinction is about what “offline” honestly means. A local AI app still needs software and model delivery: the app has to arrive on the device, model files can be much larger than the app shell, and updates need a delivery path. CuriousLM therefore uses the network for initial delivery, model and runtime downloads, and updates. Optional web search and response reports can also use the network — but only after showing the relevant content and asking for confirmation. Disclosed, cookieless aggregate analytics can be disabled in Settings and never include chat or file content. “Works offline,” he concluded, should describe a tested workflow after setup, not every moment in the product's life.
Privacy as a visible data flow
The essay's most practical argument is that the boundary should exist in the interface, not just in a policy document. A privacy policy cannot rescue a confusing interaction, Don wrote: if a button changes where data goes, that change belongs beside the button. For an optional search, the user should see the query before it is sent. For a report, the user should see the exact excerpts and optional comment before submission. A loading state should distinguish local model work from an online request — which also improves debugging, because a network failure can then produce a specific message instead of a generic error.
Keeping data local, he is careful to add, moves responsibility rather than removing it. In a browser, storage can still be cleared or evicted, so a local-first product needs export, deletion and recovery guidance rather than treating browser storage as permanent. On Android, the Keystore can keep cryptographic key material non-exportable, but the application still has to encrypt the correct records, handle unlocked sessions carefully, and explain what happens if a passphrase is lost. A local database does not neutralize third-party scripts, weak content security, or accidental logging.
Before shipping a local AI feature, Don now writes down an action-level map: inference, storage, delivery, optional network actions, analytics and diagnostics, deletion and recovery, and an offline test — a normal chat completed after disconnecting the device, once setup is finished. The checklist, he wrote, prevents a product slogan from becoming an architecture shortcut, and makes future features easier to review because every new network action has to fit into an existing boundary.
The honest trade, stated plainly
CuriousLM is free, with no account and no subscription step: download the app, download a model, and start chatting. Devices with 8 GB of RAM or more give the best experience, and model files need a few gigabytes of storage. The trade is stated plainly wherever the product is described: small on-device models are slower, they know less, and they are more likely to make factual mistakes. They are not the best choice for cutting-edge coding help, complex research, or long-form professional writing that must be perfect on the first draft.
What they are best at is the material Don built the product for in the first place: private thinking, personal writing, daily planning, offline questions, journaling, and anything you would never paste into a cloud chatbot. The test he invites is not a claim but an experiment: after setup, turn on airplane mode and use it normally for ten minutes. If everything works, you have verified the core promise with your own hands.
The biggest lesson from building CuriousLM, Don wrote, is that privacy becomes more credible when it is narrow and inspectable. Keep the normal path local. Name the exceptions. Put confirmation where the boundary changes. Then test the claim from the user's side of the screen. That is a founder story with no funding round and no growth chart — just a boundary, drawn in public, and an app built to hold it.
The playbook
- Turn a slogan into a checklist — Don replaced “local AI” with seven named decisions — inference, storage, delivery, optional actions, analytics, deletion, offline test — so every feature could be reviewed against the same boundary.
- Put the boundary in the interface — Show the query before an optional search is sent and the excerpts before a report is submitted, instead of burying data flows in a policy page.
- Show uncertainty instead of hiding it — Underlined “heat” words let users see where the model hesitated and steer the answer another way — transparency as a feature, not a disclaimer.
- State the trade honestly — Small on-device models are slower and know less; saying so plainly is what makes the privacy claim believable rather than marketing.