The most honest conversations you have
People ask AI assistants things they would never say out loud: symptoms they are scared of, debts they are ashamed of, disputes they have not told their family about. A chat window feels private in the way a diary feels private.
But a diary stays in your drawer. A cloud chat is a request to someone else's computer, and what happens after you press enter is governed by a document you almost certainly have not read.
Where a cloud conversation can travel
- Provider logs: many services retain conversations for weeks to years, even after you delete them from the UI.
- Human review: flagged conversations can be read by trust-and-safety staff or contractors.
- Sub-processors: transcription, moderation, and analytics vendors may each touch the same content.
- Legal process: retained logs are discoverable — a subpoena reaches whatever still exists.
Deletion is a promise, not a mechanism
When storage is on someone else's infrastructure, "delete" means "we promise to stop showing it to you." Backups, replicas, and derived data live on their own schedules.
The only deletion you can verify is deletion from a disk you control.
The sovereign alternative
A local-first assistant inverts the model: conversations, documents, and indexes live on your machine. There is nothing to retain because nothing was sent.
That is the design principle behind ZSearch — the confession never leaves the room.