There's a notes app. There's also what runs it.
Underneath the notes app is the part we actually spent the years on: the on-device encryption, the AI that reads your notes without ever sending them anywhere, and the permissions that decide what it's allowed to touch. The notes app is the first thing built on it — not the whole idea.
We built the hard part first — notes is where we proved it
Most AI apps start as a database, then someone bolts a chatbot on top afterward. The AI gets raw data back and has no idea what any of it means — it's just shuffling text. We built it the other way around: the encryption, the AI's permission system, and the on-device AI logic all stand on their own, independent of any single app. Notes is just the first thing we plugged into it.
We started with notes because it's the hardest possible test case — reading, writing, deleting, and syncing all happen constantly, and all of it touches every layer of the engine at once. Get notes right, and the engine underneath it is proven.
That's also why the next app we build won't start from scratch. The encryption is already solved. The AI's permission tiers and audit trail already exist. Syncing is already built. A new app only has to build its interface — everything underneath it is already built and hardening in the beta.
Unlike apps that bolt encryption or AI onto an existing database, the engine underneath Prevon was built first — so the next app inherits it instead of rebuilding it. Unlike cloud AI services, everything it does to your vault happens on your device, by default.
Three things that come with the engine, not just this app
These aren't notes-app features bolted onto an AI. They're built into the foundation itself — which means anything else we build inherits them automatically, without being rebuilt.
Permission tiers
Reading your notes is low-risk and automatic — the AI can surface information without asking. Anything that changes or deletes something asks for confirmation first. Wiping the vault requires a fresh confirmation on top of your PIN or biometric. The AI doesn't get an all-or-nothing key to your life — it gets exactly as much trust as the action requires. Want an example? The same AI that finds a note you wrote six months ago can't delete it without a separate confirmation step.
A real audit trail
Every action the AI takes — what it did, when, and why — is logged where you can see it. Most AI agents give you a black box. This one gives you receipts. Open the audit log and you see the action in plain language, not just a technical timestamp: which notes were touched, what the AI decided to do, and why.
Scope limiting
You can hand the AI access to one part of your vault without opening the rest. Your Work notes and your Personal notes can be walled off from each other, and the AI's queries are filtered so it physically cannot see across that wall — not just told not to.
What the AI actually does — and how far it can reach
Auto-filing that reads meaning, not keywords
Every note you write gets converted into a vector — a numeric fingerprint of what it's actually about, written by the AI itself as you type. That vector is what files the note into the right folder automatically, and it's the same underlying representation search uses. A meeting note about a product launch lands next to your other launch notes even if you never typed the word “launch” in either one.
Search that matches words and meaning, together
Pure keyword search misses anything you didn't phrase exactly right. Pure semantic search can miss an exact name or number buried in a sea of “similar enough” results. Prevon runs both at once — an exact match for the specific term you typed, and a meaning-based match for what you meant — so you get the precision of one and the recall of the other, not a tradeoff between them.
, not just conversational
The AI isn't limited to answering questions about your notes — it can act on them. Create, edit, organize, tag, link, or delete: essentially anything you can do to a note by hand, the AI can do on your behalf. That access doesn't bypass the permission tiers covered above — reading stays automatic, anything that changes or deletes something still asks first. The AI just gets to be genuinely useful within those boundaries, instead of being limited to read-only chat.
Local by default. A smarter cloud model, if you want it
The on-device model handles auto-filing, search, and vault actions entirely on your hardware — that never changes, regardless of any setting. Separately, if you want a more capable conversational assistant, you can opt into connecting a cloud AI provider. That channel only ever sees what you type directly to it and the recent conversation — your note content is never included in those requests, whether the feature is on or off. You can check which mode is active, and switch back to on-device-only, at any time in AI Settings. It is not enabled in the current beta build yet; the on-device path is complete, and the cloud channel ships later.
The Air Gap
The part of Prevon that touches your vault has no code path to the internet. Not “we promise not to send your data” — the networking code simply isn't there to call. If someone tricked the AI into trying to leak your notes, there's nothing in that isolated process capable of sending them anywhere. The optional cloud assistant covered above is a separate channel entirely — it can hold a conversation, but it has no path into this process and never receives your vault contents.
Designed for local sync, flat off in the beta
Prevon is built so two devices on the same network can find each other directly — you confirm the connection by scanning a QR code, and that scan is what opens the encrypted channel. No account, no login, no third party in the middle. The exchange is designed to happen entirely over your local network: nothing is uploaded anywhere to make it work, even if your router can't see the internet.
It is switched off for this private beta. Sync — cloud or device-to-device — is disabled on purpose while we test the vault against people actively trying to break in. With it off, there is no path off your device for your notes to take. The page describes what the feature is designed to do, not what this build does.