An insanely secure & private thinking partner, living at home.

How a message travels

1. Your phone

   You message her in Signal like any contact. The message is end-to-end encrypted.

2. Signal

   Signal passes it on and cannot read it. Estia has her own number, so she never sees your other chats.

3. Your Mac

   The Mac fetches it with signal-cli, a Signal program without a window, by connecting out to Signal. No part of Estia accepts connections from the internet: no web app, no open port, nothing to log in to. Ollama, the program that runs the AI model, and the voice service answer only the Mac itself, never another device.

The rules

• Only you can talk to her. Only the Signal accounts in her config get an answer, checked in code. Strangers get no reply, read receipt or typing indicator, and their calls are never picked up or rejected, since a rejection is itself a reply. Signal itself still confirms delivery.
• Only the devices she knows. A message from a new device linked to your Signal account gets no answer and never reaches the AI; a note from the code goes to your account, so your phone sees it too. /devices ok N, sent from a device she already knows, lets it in.
• An emergency stop on your phone. /lock stops everything at once (answers, messages she starts, calls and reminders) until /unlock from the same device, 10 minutes later at the earliest. It holds after a restart and needs no Mac.
• Mail and calendars are read-only. Estia reads them but never changes them. Mail is read with Microsoft's read-only permission, so the sign-in itself cannot send, move or delete. Outlook calendars use Microsoft's read-only calendar permission, Calendars.Read, and Google calendars are read through a calendar link whose secret address works like a password: never make a private calendar public for her. iCloud, Fastmail and Nextcloud calendars are read with an app-specific password, with read requests only: any other request is refused in code. The text of a mail is never stored, only its headers (sender, subject, date and the like) and a one-line summary; her answers about a mail stay in the chat like any answer.
• Outside text is read as information, not as orders. Web pages, YouTube captions, search and map results, mail, calendar entries, project files, documents, photos and shared audio files. Code rules reduce prompt injection (orders hidden in that text) but cannot rule it out. A device change after outside text waits for your yes.
• Reminders and her own messages come only from you. A reminder or a wake-up call is set only when asked for in your own words, never by a mail, a page, a video, a calendar entry or a shared audio file, and calls go only to your account. The code decides when she writes first. When the AI writes part of a message she starts, it sees only your words, your profile and the moment. Never mail, calendar entries, the web or a page. Calendar notes are written by code, from the calendar. A text with a web link is never sent, and neither is one that asks for a code or a password: those words are checked in all 11 languages.
• She can't run a command of her own. The AI model has no command line: it cannot type commands on the Mac. With Projects on, she reads only files git tracks in the folder named in setup, at the level chosen there (summary, docs or code), never secret-like files such as .env. With Documents on, her document tools read only her index of the PDFs in ~/Estia-KB.
• One folder of yours for documents. In your home folder, her account adds files only to ~/Estia-KB, and never deletes or changes yours. A PDF is read by Apple's PDFKit and Vision in a helper program that runs as her account: a PDF made to attack the reader reaches only that program and her account, never yours.
• The model stays on the Mac. A cloud model, which Ollama runs on its own servers, is refused: by its name when the config is read, and by Ollama's own list at the start, every five minutes and before every chat. Once the check sees one, answers pause and a note from the code says why.
• She only learns from you. Facts come from what you say, or from a page you ask her to learn from, and what she picks up on her own never replaces a fact you gave her. Mail, calendar, documents, YouTube captions, web and map results never teach her anything.
• Every device has a rule. Each light or plug gets one of three rules, enforced in code: normal, ask first, or never off. A note from code, not from the model, says what really changed. Philips Hue lights are reached only through the Hue Bridge on your home network, and nothing is sent to a bridge whose certificate differs from the one saved at pairing.
• What she keeps stays on the Mac. Chats and your profile stay in one database on the Mac until you delete them. Photos, voice notes and call audio are deleted after use. YouTube captions are never stored: held for 10 minutes for follow-up questions, never written to disk. With Documents on, the text of your PDFs is kept in that database until a PDF leaves the folder. Logs never hold the text of a message.
• Her own account on the Mac. She runs as _estia, her own hidden Mac account with no password and no login: not as you and not as root, the Mac's all-powerful admin account. Her data and keys are readable only by that account. Her code and every program she runs are copies owned by root, changed only by an update you run. A program you run, an AI session included, reads none of it without your Mac password (limits under Known gaps).
• Secrets are typed in Terminal, hidden on screen. Setup and each extra ask for keys, codes and passwords in your own Terminal, where what you type stays hidden: never in a chat, and never on a program's command line, where other programs on the Mac can read them.
• A security step in setup. Remote login (SSH) with keys only, no admin rule that skips your password, her files private, and a Signal PIN on her number (Registration Lock): each shown with its state, and changed only on your yes. Together they make the hardened level. FileVault, automatic login, the screen lock and a few more are shown with their fix, never changed. The nuclear level adds the Mac's firewall, with python3 and ruby (programs that run scripts) off its list: a separate choice, never part of setup, which says first that it may stop other services on the Mac. Doctor names the level the Mac is at.

What stays home, and what goes online

The model always runs on the Mac. Outside services are reached only for Signal, links you send and the extras you switch on. Mail syncs every five minutes in the background, and the digest reads the calendar each morning.

Setup also downloads the model (ollama.com), Ollama's official build (GitHub; its fingerprint and signatures checked before anything is installed) and, for calls, signal-cli and the call helper's source code (GitHub, crates.io). It runs Homebrew, the installer for Mac tools, with Homebrew's usage reports off. The voice models come from Hugging Face, an online library of AI models. The listening model (Whisper), the speech detector and Smart Turn are fixed to one version and checked against their fingerprints on the Mac at every start: a changed or extra file is never loaded. Smart Turn, which hears when a sentence on a call sounds finished, is a community conversion of Daily's model, not Daily's own. Whisper is downloaded once, then starts with no network. The speaking voices are downloaded as published, with no fixed version and no check of their files.

Updating

git pull/usr/bin/sudo /usr/local/estia/bin/estia-deploy

Run these in Terminal, in the ~/estia folder, which is only the source: she runs from a copy owned by root. The second line shows the new changes and asks first, then puts the new code live, checks her within two minutes and switches back on a failure. It asks for your Mac password. After changes in tools/voice, also run scripts/install-voice-daemon.sh. When an update changes the tools that run as root, the deploy says so and keeps the old ones: read the changes, run /usr/bin/sudo /usr/local/estia/bin/estia-deploy --update-tools, which shows them and asks, then run the deploy again.

Good to know

• She is as awake as the Mac. If it sleeps or is off, so is she. Her service and Ollama, as setup installs it, start with the Mac, without a login. With FileVault on (the Mac's disk encryption, which keeps her data encrypted), your Mac password is typed once at each start; /usr/bin/sudo /usr/bin/fdesetup authrestart restarts without that prompt. Homebrew's Ollama and the Ollama app start only after a login: setup stops and names either one, with the fix. An official Ollama that setup keeps may not start with the Mac: setup and doctor name it.
• Replies take a few seconds. At most about half a minute. The first one after a quiet spell is slower while the model loads.
• She says when she was away. After a restart she skips messages older than ten minutes and tells you she was offline, so you can ask again.
• Backups are not built in yet. Her database (chats, memory and profile) and her Signal account keys are not backed up for you.