Every AI assistant you have used has sent your data somewhere you cannot see.
Your messages, your files, your calendar, your voice — somewhere a remote service has read them, summarized them, and maybe kept them. You were probably told this in the fine print. You signed it because the product was useful and the alternative was a worse product.
The alternative does not have to be a worse product.
The cloud-first default was chosen for the vendor
Cloud-first AI assistants ship fast because their vendors can push updates, gather training data, and charge monthly. None of those three things benefit you. Fast updates mean breaking changes you did not ask for. Training data means your private text is quietly improving a model you do not own. Monthly charges mean you never actually own the tool you came to rely on.
This is not a moral failing of cloud-first vendors. It is the default that falls out of their incentives. A tool that runs on their infrastructure is a tool they control. A tool that runs on your computer is a tool you control.
We think you should control the tool.
What local-first means in Cognithor
Local-first at Cognithor is not "we have an offline mode." It is an architectural commitment. Every feature is designed assuming the model runs on your machine and nothing leaves unless you explicitly say so.
Concretely:
- Nineteen LLM roles route to local models by default. Ollama, LM Studio, and llama.cpp backends are first-class. Cloud models are supported but opt-in, per-role, and never the default.
- Six memory tiers — chat, episode, vault, identity, tactical, entity — all write to SQLite and RAM on your machine. Nothing is synced to a remote vector store unless you configure one.
- 145 MCP tools execute locally. Filesystem, shell, web search, vision, audio transcription, document export — all of them. Web tools reach outward to fetch content, but the agent runs here.
- Eighteen channel adapters — Telegram, Discord, Slack, WhatsApp, Voice, and twelve more — are just transports. The brain is on your hardware.
- Zero telemetry. No analytics pings, no crash reports, no anonymized usage tracking. Not even a "check for updates" ping unless you run
cognithor updateyourself.
We publish the Gatekeeper's audit log so you can read every tool call Cognithor ever made on your behalf. If it touches the network, you will see it in the log.
The trade
Local-first is not free. Here is what you give up:
- Cross-device sync. If you want your assistant on your laptop and your phone, you run two copies. There is a mobile pairing flow that lets them talk to each other over your local network or a VPN, but the state lives where the hardware lives.
- Scale. A 27B parameter model on a laptop is not GPT-4 on a datacenter. Local models have gotten remarkably good — good enough for daily work — but they are not the absolute frontier.
- Convenience of a SaaS install. You have to install Ollama. You have to download a model. The first run takes a few minutes.
Here is what you gain:
- Data sovereignty. Your conversations never leave your machine. Full stop. There is no "we encrypt it in transit" caveat. It never went anywhere to be encrypted.
- Offline capability. A plane, a train, a cabin in the woods — if your laptop boots, your assistant works.
- No recurring cost. You paid for the hardware. You paid for the electricity. You already own everything the tool needs to run.
- No rug pull. Cognithor cannot change its pricing model out from under you. It cannot deprecate a feature you depend on. If the project stops tomorrow, your install keeps working — and your vault is still yours.
The commitment
We wrote the Manifesto to make this concrete. Read it if you want the details on what the project will never do, and what it will always do.
The short version: your data stays on your machine, in your vault, under your keys. Never trained on. Never uploaded. Never sold. Ever.
That is the whole pitch.