Engine
There's a notes app. There's also what runs it.
Why it's built this way
We built the hard part first — notes is where we proved it
Most AI apps start as a database, then someone bolts a chatbot on top afterward. The AI gets raw data back and has no idea what any of it means — it's just shuffling text. We built it the other way around: the encryption, the AI's permission system, and the on-device AI logic all stand on their own, independent of any single app. Notes is just the first thing we plugged into it.
We started with notes because it's the hardest possible test case — reading, writing, deleting, and syncing all happen constantly, and all of it touches every layer of the engine at once. Notes is how we are testing the engine.
That's also why we hope the next app won't start from scratch. The encryption, the AI's permission tiers and the audit log are built and being tested in the beta. Syncing is compiled in but off by default, and has had no independent audit; neither has the rest of the engine. A new app should mainly have to build its interface, though the engine is still hardening and we expect to keep finding things to fix.
Rather than bolting encryption or AI onto an existing database, we built the engine underneath Prevon first, so a future app could inherit it instead of rebuilding it. The AI is designed to act on your vault on your device, by default.
Built into the foundation
Three things that come with the engine, not just this app
These aren't notes-app features bolted onto an AI. They're built into the foundation itself — which means anything else we build is designed to inherit them without rebuilding them.
01
Permission tiers
Actions are sorted into permission tiers, and you can set permissions per command. Reading your notes is designed to be low-risk and automatic, while anything that changes or deletes something is designed to ask for confirmation first. The vault-wipe commands are blocked from the AI's reach, and a wipe you start yourself needs a typed confirmation. The AI doesn't get an all-or-nothing key to your life — it is designed to get as much trust as the action requires. For example, the same AI that finds a note you wrote six months ago is designed to need a separate confirmation step before it deletes it. We have tested this ourselves; it has not been independently audited.
02
A real audit trail
The actions the AI takes are designed to be logged on your device where you can see them (Settings has a read-only Recent AI Actions list, and the log can be exported or cleared), so you get receipts rather than a black box. We have not verified that every action is recorded in this pass, and the log lives on the device, so it is only as safe as the device.
03
Scope limiting
You can exclude individual notes and folders from the assistant, and you can choose separately what the on-device and the remote kinds of AI may do. The aim is for those limits to be enforced in the app's code, not left to the AI's good behaviour. We have not independently verified that a walled-off folder is invisible to every AI path, so treat it as a design goal, not a guarantee.
The AI
What the AI actually does — and how far it can reach
Auto-filing that reads meaning, not keywords
Every note you write gets converted into a vector — a numeric fingerprint of what it's actually about, written by the AI itself as you type. That vector is what files the note into the right folder automatically, and it's the same underlying representation search uses. One honest limit: the search-by-meaning cache keeps note text unencrypted inside the app's private storage, so it is not covered by the vault encryption. A meeting note about a product launch lands next to your other launch notes even if you never typed the word “launch” in either one.
Search that matches words and meaning, together
Pure keyword search misses anything you didn't phrase exactly right. Pure semantic search can miss an exact name or number buried in a sea of “similar enough” results. Prevon runs both at once — an exact match for the specific term you typed, and a meaning-based match for what you meant — so you get the precision of one and the recall of the other, not a tradeoff between them.
, not just conversational
The AI isn't limited to answering questions about your notes — it can act on them. Create, edit, organize, tag, link, or delete: essentially anything you can do to a note by hand, the AI can do on your behalf. That access doesn't bypass the permission tiers covered above — reading stays automatic, anything that changes or deletes something still asks first. The AI just gets to be genuinely useful within those boundaries, instead of being limited to read-only chat.
Local by default. A smarter cloud model, if you want it
The on-device model is designed to handle auto-filing, search, and vault actions on your hardware, whatever other settings you choose. Separately, we plan to let you opt into connecting a cloud AI provider for a more capable conversational assistant. That channel is designed to receive only what you type directly to it and the recent conversation, not your note content, whether the feature is on or off. You would be able to check which mode is active, and switch back to on-device-only, in AI Settings. The cloud option is compiled off in current builds; it is planned for a later release. You can already point the assistant at a server you run yourself, but it does nothing until you add one. The on-device models are downloaded from huggingface.co, which can see your IP address and which file you asked for.
Isolation
The Air Gap
The AI runs on your device, and the rules for what it may do sit in the app's code, not in a prompt. We aim to keep the part that touches your vault separate from anything that talks to the network, and Air-Gap Mode (off by default) blocks the app's outbound calls. We have not proven that the AI has no path to the internet, and the app does contain networking code (for model downloads, an optional server you run yourself, and Ghost Sync when you turn it on). The planned optional cloud assistant covered above is meant to be a separate channel that never receives your vault contents. This describes our design and the current build, and no design is free of bugs.
Device to device
Designed for local transfer, off by default
Prevon is designed so two devices on the same network can find each other directly: you scan a QR code or type a short pairing code, and that starts the encrypted channel. The design needs no account, no login, and no server in the middle for this device-to-device transfer, and nothing is meant to be uploaded to make it work. Two limits: the nearby-transfer protocol is not yet bound to the pairing code, and the transfer path has not been independently audited.
Cloud sync is off by default. Ghost Sync and sharing are compiled into the source but every switch starts off, and our scripted release builds leave them out unless we choose to include them. With them off, the app is not designed to send your notes off your device. The page describes what the feature is designed to do, and we have not run a network capture of a default-settings app.