18 Oct 2026 · 4 min read · AI · privacy · product
Local first: privacy you can test
A privacy policy is a promise. A product that never connects is a fact. Why I design for local first, and what that honestly costs.
By Stephan von Falkenstein
Most privacy is a paragraph. "We take your privacy seriously" is a sentence anyone can write, and nobody can check.
I'd rather build things where the privacy is a property of the product, something you could test yourself, than a promise in a policy. That's what I mean by local first. It's a design decision made at the start, not a checkbox at the end.
Dictation that never leaves your PC
WREN is my dictation app for Windows. You hold a key, talk, and the words appear at your cursor.
The well-known tools in this space send your voice to their servers. WREN doesn't, because there's no server to send it to. The speech engine ships inside the app and runs on your own processor. Audio is transcribed in memory and then discarded. There's no account and nothing to sign in to.
The part I care about most: that promise is tested, not trusted. An automated check blocks the network layer while the app runs, and the build fails if anything reaches for a connection. The privacy page can say "no network connection while in use" because the build won't ship otherwise.
Even the licence works this way. The $49 key is verified on the device. A licence check that phones home would quietly break the main promise, so there isn't one.
Honest about the cost
Local first isn't free, and I think it's worth saying so plainly.
- The download is large, because the speech model travels with the app instead of living on somebody else's computer.
- A licence key can be shared. Stopping that would need an activation server, and that's the thing I promised not to have.
- There's no account to recover anything from. Your vocabulary is a plain text file you own. If you want it on another machine, point WREN at a folder you already sync, whichever cloud you already trust. Your history stays on the machine that made it.
Each of those is a trade I'd make again. But a product that hides its costs isn't really being honest about its benefits either.
The same rule on the web
My websites follow the same thinking, within what a website can do.
This site counts visits with its own small beacon, not a third-party tracker. By default it doesn't store your IP address: it keeps a hash that changes every day, so one visit can be grouped and two days can't be linked. The country on my dashboard comes from your browser's time zone, not from sending your address to a lookup service. That's coarse, and the dashboard says so. A time zone is roughly where someone is, not a record of where they are.
On Mars Deck, where location is resolved more precisely, that happens on my own server with a local database. No third party sees who visits.
Name what your data touches
Local first doesn't mean pretending nothing ever leaves the device. Some features need a service. Mars Deck's assistant runs on xAI's Grok, because your question has to go somewhere to be answered.
The rule I follow is simple: if your data reaches someone, I name them, on the page and in the privacy policy, in plain words. Your question goes to Grok. Your payment goes to PayPal. Everything else stays with you or with me.
Why I build this way
As AI moves into everything we type and say, where it runs starts to matter. Your voice, your drafts and your questions are some of the most personal data there is.
Running locally keeps the answer to "who can see this?" short. And once the privacy is a fact rather than a promise, it's one less thing anyone has to take on trust.