private Trust
Local first, and no score on anyone
A tool that observes work has to answer two questions before any other: where the data goes, and who judges whom. The answers are here, with their limits.
Principles
Three design principles
Stated without promising beyond what is actually implemented.
Local first, by default
Work data and its context stay local by default. When an external model is used, what is sent is limited to what is necessary.
Deterministic first
Classic, deterministic processing is preferred wherever generative AI adds nothing. Language model calls are reserved for the steps that need them, with the ability to switch provider.
Proposals, not verdicts
The analyses produced remain proposals: the user can check, correct or refuse them. Making work visible and understandable, not scoring or monitoring people.
Where the data goes
“Local first” is not “offline”
Processing happens on your machine by default. Whatever has to leave it — a model call, a backup — is minimised, governed and visible. The distinction is written here because it can be checked: promising fully offline operation would sell better and would be false.
You choose what is observed, source by source. Each source is switched on and off separately.
Calls to an external model, backups and synchronisations are explicit, not implicit.
Data at rest is encrypted; access tokens for connected services are isolated and encrypted separately.
Exporting and deleting personal data are commands in the product, not a request to file.
Who decides
The system proposes, you decide
No score, no screenshot, no productivity judgement. Keeping records current is not rating people.
Every piece of state points back to what produced it. A claim without a source does not have to be believed.
What the system is unsure it understood is marked as such, not smoothed over. Periods it could not attribute stay visible rather than filled in.
Your corrections are the system’s learning loop, not an exception to be handled.
Objections
The three questions that keep coming up
“This is surveillance.” You keep control of your data and your approvals. There is no scoring, no screenshot, no ranking of people.
“This is a time tracker.” Time is an output, not the promise. What is aimed at is a state of the project that is usable, sourced and justifiable.
“My assistant already has connectors.” Connectors expose sources. Private Twin maintains the links, the state and the uncertainties between those sources.
How the website itself handles data — cookies, logs, third-party requests — is described separately. See the website privacy notice