# Fidaro > Fidaro is privacy-first, zero-knowledge AI chat. Conversations are end-to-end > encrypted between your device and a hardware-attested confidential virtual > machine (CVM); Fidaro's own servers cannot read message content, cannot tie > your identity to what you said, and do not use conversations to train models. Fidaro is built by a team including ExpressVPN alumni. The product runs open-weight LLMs on Fidaro's own hardware inside Intel TDX confidential computing, verified by cryptographic attestation before any message is sent. Fidaro automatically routes each conversation to the best model for the task; conversations are never proxied to the models' creators. Product capabilities include Projects (a dedicated space that groups related chats and carries its own instructions shaping every chat inside it; the project name, description, and instructions are end-to-end encrypted like message content), image and document uploads (encrypted in transit, not retained today — encrypted file storage is planned), Disappearing Chat, and encrypted chat history synced across devices. ## Core pages - [How Fidaro Works](https://fidaro.ai/how-it-works/): The full architecture — confidential computing (CVM), attestation, Passkey-derived encryption keys, in-flight Noise-protocol encryption, and encrypted storage. - [Why Fidaro](https://fidaro.ai/why-fidaro/): The privacy and confidentiality risks of mainstream AI chatbots and how Fidaro's architecture addresses each one. - [Meet the Team](https://fidaro.ai/meet-the-team/): Founders and engineers, including background building ExpressVPN's TrustedServer platform. - [Privacy Policy](https://fidaro.ai/privacy-policy/): What data Fidaro collects, what it structurally cannot access, and why. - [Terms of Service](https://fidaro.ai/terms-of-service/): Terms of use. ## Key definitions - **Zero-knowledge**: Fidaro's servers cannot read your conversations. Prompts and responses are never logged or stored in readable form — synced history exists only as end-to-end encrypted data Fidaro cannot decrypt — and conversations are never used to train AI models. - **End-to-end encryption (E2EE)**: Messages are encrypted on the user's device, with keys derived from the user's passkey, before they are sent or stored. Only the user's devices and the attested CVM can decrypt them — Fidaro's servers, its staff, and the models' creators never hold the keys or readable content. - **Confidential computing / CVM**: A Confidential Virtual Machine is a server whose memory is encrypted by the processor itself (Intel TDX), so that even Fidaro's own infrastructure operators cannot see data being processed inside it. - **Attestation**: A cryptographic report, signed by the processor, that proves to a connecting device that it is talking to the genuine, unmodified CVM before any sensitive data is sent — verified against Intel's certificates and Fidaro's published code measurements. ## Optional - [llms-full.txt](https://fidaro.ai/llms-full.txt): The complete text content of the site in one document — architecture explainers, risk comparisons, FAQs, blog posts, team, and legal pages. --- ## How Fidaro Works (https://fidaro.ai/how-it-works/) ### Introduction Fidaro secures your AI conversations through an architecture that keeps your messages private at every stage. Unlike traditional AI services, where your conversations pass through company servers in readable form, Fidaro encrypts your data before it leaves your device and keeps it encrypted through every step of processing. The system combines a hardware-isolated confidential computer, attestation you can verify, and Passkey-based encryption to create a service where we genuinely cannot read your messages, even if we wanted to. This addresses a fundamental problem with most AI services today: you have to trust that companies won't look at your data, won't be breached, and won't be compelled to hand over your information. Fidaro replaces that trust with mathematics and hardware. Privacy isn't enforced by policy; it's enforced by system design. Two ideas do most of the work. First, the entire backend runs inside a confidential virtual machine: a computer whose memory is encrypted by the processor itself, so that even the people who operate the servers cannot see what happens inside. Second, the key that decrypts your data is derived from your Passkey on your own device and never reaches us. The rest of this document walks through how these pieces fit together. ### 1. The Confidential Computer: Hardware-Backed Privacy At the heart of Fidaro's security model is a Confidential Virtual Machine, or CVM, running on Intel's TDX technology. A confidential VM is an ordinary-looking server with one extraordinary property: the processor encrypts its memory and shields it from everything outside, including the host operating system, the cloud provider, and our own administrators. Think of it as a vault built into the server, one that even we cannot open. Whatever runs inside is invisible from the outside. Everything that touches your unencrypted messages runs inside this single protected environment: the component that holds the encryption keys, the relay that routes requests, and the AI model itself. Because they all live inside the same hardware-isolated boundary, your message is only ever readable in a place that no operator, engineer, or infrastructure provider can observe. If our surrounding infrastructure were completely compromised, an attacker still could not reach inside the CVM to read what's being processed. What makes this powerful is that the CVM isn't just isolated; it's verifiable. Before your device trusts it with anything sensitive, it demands cryptographic proof that the CVM is genuine and running exactly the code we published. That verification is called attestation, and it's what turns "trust us" into "verify for yourself." ### 2. Attestation: Cryptographic Proof Before Trust Attestation is how your device confirms it is talking to the real, untampered CVM before sending any sensitive data. When your browser connects, it asks the CVM for a signed attestation, a report produced by the processor itself that contains precise measurements of the exact software running inside. Think of it like a passport that can't be forged: it proves not just that the environment exists, but that it is running the specific code we published and nothing else. Your device checks this report against Intel's certificates and against the measurements we publish. It confirms the hardware signature is genuine, that the report was freshly generated for this request, and that the measurements match the expected values down to the byte. Crucially, the report is cryptographically tied to the encryption key the CVM will use for your session, so a verified report also proves you'll be talking to that exact protected environment and not an impostor in the middle. If any check fails, whether altered code, an invalid signature, or an unexpected measurement, your device refuses to continue. This happens automatically, before a private channel is ever established, and it doesn't rely on trusting our word. ### 3. Your Passkey Unlocks Your Vault Fidaro deliberately separates two questions that most services blur together: who are you? and can you read your data? The first is identity; the second is your encryption vault. Keeping them apart means that even our own login system never comes near the keys to your messages. For identity, you sign in with a passwordless email link. That proves who you are and gives you a session, but it grants no ability to decrypt anything. The keys to your data come from somewhere else entirely: a Passkey. A Passkey is the same technology that lets you unlock apps with Face ID, a fingerprint, or your device PIN, a credential that lives in your device's secure hardware and never leaves it. Fidaro uses a capability of modern Passkeys that lets your authenticator produce a secret unique to your Passkey each time you use it. Your browser turns that secret into your encryption key, locally, on your machine. This is the crucial property: that secret, and the key derived from it, never travel to our servers. We store only an encrypted bundle containing your data key, locked so that it can only be opened by the secret your Passkey produces. When you unlock your vault, your browser asks your Passkey for the secret, derives the key, and opens the bundle, all on your device. We never see your Passkey's secret, never see the derived key, and never see your data in readable form. Because the secret comes from hardware you control, we cannot be compelled to hand over something we never possess, and an attacker who guessed at your data would get nowhere without your physical Passkey. ### 4. Recovery and Multiple Devices Because the key to your data lives with your Passkey, Fidaro gives you two ways to stay in control across devices and over time. Most modern Passkeys sync securely through your platform, such as iCloud Keychain or Google Password Manager, so signing in on a new phone or laptop reproduces the same Passkey secret and unlocks the same vault automatically, with nothing extra to do. For everything else, you can generate a recovery code: a short list of ordinary words that encodes a strong, random secret. Behind the scenes, this code is put through a deliberately slow, memory-intensive process to derive a second key that can also open your vault, and that key wraps a separate encrypted copy of your data key. The words are shown to you once and never stored on our servers. If you arrive on a device that doesn't have your Passkey, entering the recovery code unlocks your vault and then re-secures it under a fresh Passkey on that device. As with everything else, the recovery secret only ever exists on your device; we keep nothing that could open your data on our own. ### 5. A Private Channel into the Enclave Every time you start a conversation, your device and the CVM establish a fresh encrypted channel using a protocol called Noise. The session keys for this channel last about fifteen minutes, are generated new each time, are never reused, and are never written down anywhere. This gives what cryptographers call forward secrecy: even if a future key were somehow exposed, it could not be used to unlock traffic from past sessions. Setting up the channel takes a brief two-message handshake. Your device generates a one-time key pair and combines it mathematically with the CVM's public key, the same key that was vouched for during attestation. The CVM responds with its own one-time key pair. After this exchange, both sides have independently arrived at the same session keys without ever transmitting them. They exist only in your browser and inside the verified CVM, and nowhere else in our infrastructure knows them. The important detail is that these keys are bound to the specific environment your device just verified. You're not establishing a secure channel with "some server"; you're establishing it with the exact, attested, hardware-isolated CVM running the code we published. When the fifteen minutes are up, both sides discard the keys. An attacker who recorded today's encrypted traffic as it crossed our network, then breached our systems tomorrow and captured the session keys in use by then, still could not read what they recorded: the keys that protected it were ephemeral and no longer exist. ### 6. In-Flight Encryption: Protecting Messages During Transit When you send a message, it is encrypted on your device before it ever touches our network. Your browser uses the session keys to seal the message into a payload that is meaningless to anyone without those keys. That sealed payload then travels through our infrastructure: web servers, load balancers, network equipment. It stays completely unreadable the entire way. What makes this distinctive is where the message is finally opened: inside the confidential VM. Our gateway acts as a plain relay, passing the sealed payload along without the ability to open it; it doesn't hold the session keys, only your browser and the CVM do. Inside the protected environment, the message is decrypted, handed to the AI model for processing, and the response is sealed again before it leaves. The gateway sees nothing but encrypted blobs flowing in and out. At no point does your message exist in readable form outside your browser and the hardware-protected CVM. Our servers, load balancers, and network equipment only ever handle encrypted data they cannot open. Even thorough infrastructure logging would reveal nothing, because there is nothing to reveal: the keys live only in your browser and inside the CVM's shielded memory. A small amount of non-content information does travel alongside the encrypted message, such as which model to use and, after a response, how many tokens it used, so we can enforce limits and account for usage. This is deliberate and limited to operational metadata. The actual content of your prompts and the model's replies is never among it. ### 7. Separation of Concerns: Dividing Identity from Content One of Fidaro's core architectural decisions is making sure no single system can connect who you are with what you say. Even if one part of our infrastructure were compromised, an attacker could not link your identity to your message content. Our identity system handles your email address and issues the session tokens that prove you're signed in. It never sees your message content, and, as described above, it never holds the keys to your data. It verifies who you are and stays completely separate from the message pipeline. The gateway that relays your encrypted messages, meanwhile, operates without knowing who you are. Before your requests reach it, our front-end strips away cookies, authentication tokens, IP addresses, and other identifying metadata, and forwards only what's needed to process the request. The gateway sees encrypted content it cannot open, with no way to tell which person sent it. One side of our system knows who you are but not what you're saying; the other knows what is being asked but not who is asking. ### 8. Encrypted Storage: Protecting Your Chat History Your conversation history is encrypted before it is ever stored. We sync the encrypted data across your devices so your history follows you, but the keys needed to read it exist only on your devices, derived from your Passkey through the process described earlier. The encrypted blobs may live on our servers; the means to decrypt them never do. Every message and conversation title is encrypted on your device with your data key before it is sent for storage, and so is the way you organize them — the name, description, and instructions you give a Project are encrypted in exactly the same way. Even the role of each message, whether you or the assistant wrote it, is sealed inside the encrypted payload, so the stored records reveal as little as possible. Without the key, which we never receive, the stored data is just meaningless bytes. We can hold encrypted history, but we cannot read it. To balance security with convenience, your browser keeps your vault unlocked for up to eight hours of activity, re-securing as you go. After a period of inactivity the vault locks, and a quick Passkey check re-derives your key and restores access. The key is held only for the active session and is wiped from memory when you lock the vault or sign out; it is never sent to us and never stored anywhere we can reach. ### The Result: Privacy by Design These layers combine into a system where privacy is built into the structure rather than promised on top of it. Your identity and your data are kept apart. The key to your messages is derived from your Passkey on your own device and never reaches us. Messages stay encrypted from the moment they leave your browser until they're opened inside a confidential computer whose memory no operator can see, and they're sealed again before they leave. The history we store is encrypted with keys we don't have, and the session keys that protect each conversation expire and disappear. We designed it this way on purpose: to remove our own ability to read your messages, even under pressure to do so. There are no master keys in our possession, no store of decrypted conversations, no logs of message content. An attacker who compromised our entire infrastructure still could not connect the who to the what in any meaningful way. Privacy in Fidaro isn't a policy or a promise to be careful. It's a property of the architecture itself: a service built, deliberately, so that we know nothing about what you're saying. ### How-it-works FAQ ### What is a Confidential Virtual Machine (CVM)? It’s a special server whose memory and communication channels are encrypted by the processor itself, shielded from the operating system, the cloud provider, and even Fidaro’s administrators. Think of it as a vault built into the server that even we cannot open. Everything that touches your unencrypted message lives inside this boundary. ### Is there independent verification of this, or is the CVM claim just something Fidaro says? Attestation is the verification. Before any conversation begins, your device checks cryptographic proof, called attestation, that confirms exactly what code is running and that it matches what we’ve published. This check happens automatically, every time, and comes from the processor itself rather than from us. If anything doesn’t match, your device refuses to connect. ### What happens if Fidaro’s servers are breached or an employee goes rogue? It wouldn’t matter. Your messages are only ever readable inside the CVM, never anywhere in our surrounding systems. There is no database, admin tool, or internal screen that shows message content, so there is nothing for an attacker or an employee to find. ### If you don’t keep any records of my messages, how do you fix bugs or improve the product? We look at operational metadata, such as which model handled a request and how long a conversation ran, so we can manage usage and limits. The model itself also assigns each conversation a broad topic label, such as "coding" or "writing help," as part of generating its response inside the CVM. Only that label leaves the protected environment; the message that produced it never does. We never look at what you or the AI actually wrote, unless you choose to share something with us directly, like through a support request. ### Can Fidaro connect my identity to what I said, even behind the scenes? No, and this is on purpose. One part of our system knows who you are (your email, your login). A completely separate part handles your actual messages, and it never knows who you are. We built it this way so no single part of Fidaro ever has both pieces at once. ### Why do I need a Passkey instead of just a password? A password only proves it’s you logging in, it doesn’t protect your data on its own. A Passkey is the same technology that unlocks apps with Face ID, a fingerprint, or your device PIN. It lives in your device’s secure hardware and never leaves it. Fidaro derives your encryption key from your Passkey, locally on your machine, so the key to your data comes from hardware you control and is never sent to Fidaro. That’s something a password can’t do. ### Is what I type actually protected while it’s being sent, not just afterward? Yes. Each session opens a private channel directly between your device and the CVM, with keys that exist only in those two places. That channel resets on a regular basis, so even a future compromise couldn’t unlock a past conversation. ## Why Fidaro (https://fidaro.ai/why-fidaro/) ### Your prompts can contain sensitive data (even when you don’t mean to) **The problem:** Normal questions often include details that identify you, your work, or other people. **Example:** “Rewrite this email to Sarah at Acme about the renewal discount and include the updated pricing we agreed on.” **The risks:** - You accidentally share personal identifiers (names, emails, addresses, credentials) - You expose confidential business context (customers, pricing, roadmaps, contracts) - You paste sensitive info you didn’t realize was sensitive until later **How Fidaro addresses it:** - End-to-end encrypted chats — we can’t read your conversations, even if we wanted to. - Your chat history stays yours — it syncs between your devices fully encrypted, unreadable to our servers. - Your data, your control — not used for training, ever. ### Your data can be used for training (depending on the provider/settings) **The problem:** Mainstream AI policies vary: some data can be used for training or evaluation unless you’re on specific plans or settings. **Example:** A teammate uses a personal account to paste internal content – your org’s intended settings don’t apply. **The risks:** - Your data may be used in ways you didn’t intend (policy and product changes over time) - “Opt out” can be confusing, incomplete, or inconsistent across features - Teams may assume they’re protected when they’re not (especially across accounts) **How Fidaro addresses it:** - A simpler promise: your chats are not used to train shared models (if that’s true for you). - Clear, default protections that don’t rely on every user flipping the right switch. ### “30 days” isn’t the whole story (retention can change when law and lawsuits show up) **The problem:** Most mainstream AI chatbots say they retain chats for a limited window (often around 30 days) — but the reality is that retention can be policy-dependent, product-tier-dependent, and sometimes overridden by legal requirements. **Example:** “I deleted that chat.” A retention policy might mean “removed from your view,” not “immediately gone everywhere,” and court orders can change the rules midstream. **The risks:** - What you think is “temporary” can still be stored in backend logs during the retention window - Legal preservation orders can force providers to retain logs beyond normal deletion timelines (even for deleted/temporary chats) - Your privacy ends up depending on court filings, not just product settings **How Fidaro addresses it:** - No readable archive to retain: your history exists on our servers only as encrypted data we cannot decrypt. - End-to-end encrypted: we can’t read your chats, even if compelled. - No training: your prompts don’t become part of anyone’s dataset. ### Mainstream chatbots can shape the conversation (bias, refusals, and “politically correct” omissions) **The problem:** Many mainstream chatbots apply broad, one-size-fits-all moderation and ranking. That can lead to answers that feel inconsistent, overly cautious, or subtly shaped. **Example:** “Give me arguments for and against X” → you get one side strongly framed, or key points missing. **The risks:** - The model refuses legitimate requests (“can’t help with that”) in unclear ways. - You get safe, generic answers that omit important nuance. - The assistant’s “style” can push a viewpoint, even when you asked for neutral information. **How Fidaro addresses it:** - More control over your assistant experience (tone, strictness, neutrality). - Less “mystery behavior” — fewer unexplained detours, more direct responses. - Personalization you control — set the tone and strictness you want, instead of one-size-fits-all moderation. ### Why settle for one model? Different models are better at different things **The problem:** Most mainstream chatbots lock you into one provider’s model and one provider’s policies. But the reality is: some of the most impressive new models aren’t all offered by the same companies — and when you look outside the usual options, a common hesitation is simple: I don’t want my private prompts accessible to foreign governments. **Example:** “I want to test that model everyone’s talking about – but I don’t have a subscription and I don’t want to send personal/work prompts into a system I don’t trust.” **The risks:** - You’re limited to a single model even when another is better for your task (coding, writing, reasoning, research). - Comparing models usually means copying the same sensitive prompt into multiple services (more exposure points). - You avoid trying certain high-performing models because you don’t want your data stored or reachable under foreign government authority. **How Fidaro addresses it:** - The best of multiple leading open models, picked for your task — all running on Fidaro’s own hardware, so benefiting from a new model never creates a new privacy risk. - End-to-end encryption: we can’t read your chats, even if we wanted to. - Encrypted chat history: there’s nothing readable sitting on a server to hand over later. ## Homepage FAQ (https://fidaro.ai/) ### Does Fidaro store or read my conversations? Your conversations are encrypted on your device before they’re ever stored, then synced across your devices so they follow you. We hold only encrypted data, never the readable version. The key that decrypts it is derived from your Passkey and never reaches us, so even our own engineers can’t read what you’ve written. ### Can Fidaro be forced to hand over my data by a court or government? We cannot hand over what we do not possess. The key to your data is derived from your Passkey on your device and never reaches us. There are no master keys in our possession and no store of decrypted conversations to compel. ### How is this different from ChatGPT, Gemini, or other AI chatbots? Most AI chatbots retain your conversations by default, and their own privacy policies say so. That data can be kept for training, kept for the company’s own records, and in several widely reported cases, has been ordered by courts to be preserved and handed over during lawsuits, whether or not the user was ever part of that case. Fidaro is built so there’s no readable data to retain, train on, or produce in the first place. Your messages are encrypted before they leave your device, and the key to read them never reaches us. ### Can I try Fidaro for free? Yes. Send a few messages right away, no account needed. If you want full access, create an account, it’s completely free during beta. Our main goal right now is learning from real users, so we’ll be reaching out and asking for your feedback along the way. ### Which AI models can I talk to through Fidaro? Fidaro automatically routes your conversation to the best of several leading open models for the task — all running on Fidaro’s own hardware, inside the same protected environment. Nothing is ever sent to the models’ creators, so neither they nor Fidaro see who you are or what you said. We keep adding new models to that pool, so the AI answering you keeps getting better without you having to do anything. ### Is this actually private, or just another privacy policy? Privacy on Fidaro isn’t a policy, it’s the architecture. Your messages are encrypted on your device, processed inside a hardware-isolated environment, and unlockable only with a key that never reaches us. There’s nothing to promise, because there’s nothing for us to access. ### Can I organize my chats into Projects? Yes. A Project is a dedicated space for one ongoing topic or piece of work, so related chats stay together. You create one from the sidebar, and each Project has its own instructions that shape every chat inside it, so you don’t have to re-explain your context every time. Existing chats can be moved into a Project from the chat header. The project name, description, and instructions are encrypted on your device just like your messages, so the way you organize your work is as unreadable to us as the work itself. ### Can I upload images or documents to Fidaro? Yes. You can upload a screenshot, photo, chart, or document and ask Fidaro to explain, summarize, or analyze it. Uploads are encrypted on the way to the model, so they carry the same protection as your messages. They aren’t kept, though — an upload lasts for the session you’re working in, and refreshing the page clears it, so you’ll need to upload the file again to come back to it. Encrypted file storage is on the way, and once it ships uploads will be stored the same way the rest of your history is — encrypted on your device, unreadable to us. ## Team (https://fidaro.ai/meet-the-team/) ### Dan Pomerantz — Founder & Investor Entrepreneur who enjoys building companies from scratch. Co-founded ExpressVPN and now building privacy-first AI tools. Focused on data-driven customer acquisition. Has strong opinions about CAC, LTV, and many other acronyms. Married, father of 3. No pets at home or the office. Moved to Singapore for the business environment. Stayed for the chewing gum availability. ### Peter Burchhardt — Founder & Investor **Entrepreneur & Founder:** I'm the guy who tried to sell underpants, oil paintings, and herbal remedies before co-founding ExpressVPN with Dan and sticking with that for 14 years. Now I’m building [Titanium Birch](https://www.titaniumbirch.com). My job description there is basically "Chief Organization Designer" with the ambitious goal of building a firm that outlasts me. **Philosophy:** I'm heavily influenced by the Non-Aggression Principle and Ayn Rand's Objectivism. I'm an optimist who believes in progress—and that effective error-correction is the key to knowledge growth. If only humans had figured this out sooner, we'd be immortal. **Fidaro:** I’m a founder of the company, alongside a team of ExpressVPN alumni including my former co-founder Dan. My main focus today is building Titanium Birch, while staying closely involved in shaping Fidaro. ### Shaun Smith — CTO Security engineer who spent decades building privacy-preserving systems designed to trust nothing, and now can't turn it off. Created TrustedServer for ExpressVPN - a secure, cryptographically verified, in-memory operating system with amnesia. Now building Fidaro, writing about supply chain security, and explaining to friends why their smart home setup keeps me up at night. ### Kayan Lim — CMO With over a decade in performance marketing, I’ve specialized in scaling high-growth programs across both the consumer cybersecurity space and my own e-commerce DTC brand. I’ve spent my career building systems that trade vanity metrics for actual ROI. ### Andrew Parker — Founding Engineer A lapsed number theorist who found his way into software engineering. I'd describe myself as a generalist software engineer. I've been lucky enough to work in a very broad range of technical areas, including - Low level development. - App development across all major platforms - and some long forgotten ones. - Server side development. - Performance testing, load testing, stress testing, and more. ## Blog (https://fidaro.ai/blog/) ### Introducing Projects: Keep Related Chats Together (https://fidaro.ai/blog/introducing-projects/) *2026-08-14 · Fidaro Team* Projects give each ongoing topic its own space in Fidaro, bringing related chats and custom instructions together in one place. Everything inside a Project is protected with the same encryption as your conversations. ## Some work doesn’t fit in one chat A single conversation is fine for a single question. But most of the things people actually use AI for aren’t single questions. Planning a trip takes a dozen conversations. So does a renovation, a tax year, a job search, or anything you come back to week after week. Each time you pick it up again, you’re starting from scratch: finding the old chat, scrolling to remember where you left off, and re-explaining the context you already explained twice. Projects fix that. A Project is a dedicated space for one ongoing topic, task, or piece of work, so related chats stay together and are easier to come back to. Projects are live in Fidaro now. ## Create a Project You create a Project from the sidebar. Give it a name, add a short description if it helps, and it’s ready. {% demo src="/videos/blog/introducing-projects/create-a-project" caption="Creating a Project from the sidebar." /%} From then on, that Project has its own space: its own chat list, and a **New chat** button that starts a conversation already inside it. ## Give a Project its own instructions This is the part we’re most pleased with, and the part that makes a Project more than a folder. Every Project has its own **Instructions** — standing guidance that shapes every chat inside it. You write them once, and they apply to every conversation in that Project from then on. No more re-explaining your situation at the top of each new chat. {% demo src="/videos/blog/introducing-projects/project-instructions" caption="Project instructions shape every chat inside the Project." /%} For a home renovation Project, that might be: - Keep the style warm, modern, and timeless, with natural wood and simple finishes. - When recommending products or materials, give me a good, better, and best option with rough cost differences. - Flag anything likely to require permits, structural work, electrical, or plumbing. - If a recommendation depends on dimensions, budget, or location, ask me before making assumptions. That’s the context you’d otherwise be retyping constantly. Now it’s part of the Project. ## Move chats you already have Already have conversations you want to organize? You don’t have to start over. Open any chat and move it into a Project directly from the chat header — into an existing Project, or into a new one you create on the spot. {% demo src="/videos/blog/introducing-projects/add-chat-to-project" caption="Moving an existing chat into a Project from the chat header." /%} ## Organized, and still unreadable to us Other AI tools have projects too. The difference is what the company running them can see. How you organize your work says a lot about you. A list of project names is a list of what you’re dealing with right now — the renovation, the diagnosis, the case, the company you’re quietly thinking about leaving. On most platforms, that structure is ordinary database content: readable, searchable, and available to the provider. Not here. The project name, the description, and the instructions you write are encrypted on your device with your key, exactly the way your messages are. We hold the encrypted data. We don’t hold the means to read it. So the way you organize your work is as unreadable to us as the work itself. You can see how the encryption works on our [How It Works](https://fidaro.ai/how-it-works/) page. Privacy shouldn’t mean settling for a worse product. Projects is the first of several things we’re building on that principle: the features you’d expect anywhere else, without the trade you’re usually asked to make. [Try Projects now →](https://app.fidaro.ai) ### Image Uploads, Better Answers, and a Faster Fidaro (https://fidaro.ai/blog/image-uploads-and-a-faster-fidaro/) *2026-08-07 · Fidaro Team* Fidaro is now faster and smoother to use, especially on mobile. You can also share screenshots, photos, charts, and documents and ask questions about what’s in them, with simpler sign-in too. ## You told us you wanted a faster experience So that’s where we started. Since launch we’ve cut response times significantly — the gap between sending a message and seeing an answer is a lot shorter than it was in the early beta. But speed wasn’t the only thing we worked on. ## Fidaro now supports image uploads You can upload a screenshot, photo, chart, or document and ask Fidaro to explain, summarize, or analyze it. It’s the change that most expands what you can actually bring to a conversation: a lab result, a contract clause, a spreadsheet you don’t want to retype, an error message you’d rather not paste into a public chatbot. Worth knowing how uploads behave today, because it’s a deliberate choice and you’ll notice it. Images are encrypted on the way to the model, so they carry the same protection as your messages. They’re also not kept — an upload lasts for the session you’re working in, and refreshing the page clears it. If you want to come back to an image later, upload it again. Encrypted file storage is on the way. Once it ships, uploads will be stored the same way everything else in Fidaro is: encrypted on your device, unreadable to us. ## Better answers We’ve improved how Fidaro interprets what you’re asking and increased the accuracy of the responses that come back. Fewer misread questions, fewer answers that address the thing next to what you meant. ## A smoother experience on mobile Most of you are using Fidaro on a phone, so it should feel like it was built for one. This release makes it smoother and easier to use on smaller screens. ## Easier sign in Signing in and getting into Fidaro is now much more straightforward. Passkeys give you strong, phishing-resistant security, and there’s no reason that should come with friction attached. ## And a long list of bug fixes We cleaned up the smaller issues that were getting in the way — the ones that don’t make headlines but make the product feel unfinished. If you tried Fidaro early on and it didn’t quite click, come back and give it another shot. We think you’ll notice the difference. [Start a chat →](https://app.fidaro.ai) ### Why We Built Fidaro (https://fidaro.ai/blog/why-we-built-fidaro/) *2026-06-18 · Fidaro Team* Meet the ExpressVPN alumni behind Fidaro and why they rebuilt AI chat to be private by architecture, not policy — encrypted, verifiable, never mined. ## From ExpressVPN to Fidaro The team behind Fidaro has been thinking about privacy for a long time. Fidaro was created by the co-founders and early employees of ExpressVPN, a group of people who spent years building privacy products for millions of users around the world. That experience shaped how we think about technology, and it shaped the way we approached AI from the beginning. At ExpressVPN, we learned that people care deeply about privacy, but don’t want it to feel complicated. They don’t want to study technical settings, compare protocols, or become security experts just to use a product. They want something that works, feels simple, and gives them confidence that the hard parts are being handled properly. We also learned that real privacy cannot depend only on what a company says in a policy. Policies matter, but they aren't enough. A policy is a promise about how a company intends to behave, while architecture determines what the company can and cannot do in the first place. That distinction has always mattered. With AI, it matters even more. ## Why AI Privacy Feels Different AI isn’t like the other tools we use online. A search engine knows what you look up. A social app knows who you talk to. A bank knows what you spend. Those are all sensitive in their own ways, but AI can become something more personal. It can start to hold a record of how you think. People don’t just use AI for facts or quick answers. They use it to work through unfinished thoughts, private questions, personal decisions, and things they may not be ready to say out loud. For example, someone might ask: - “Do you think my partner is losing interest in me?” - “These symptoms started three weeks ago. Should I be worried?” - “How do I ask my boss for a raise?” - “Am I making the wrong decision about my job?” - “How should I talk to my child about something difficult?” These aren’t normal search queries. They’re the kinds of questions people ask when they’re thinking through something real. That’s why AI is so useful, and exactly why the privacy problem matters so much. The better AI gets, the more personal it becomes. The more it helps you think clearly, write honestly, or work through something difficult, the more likely you are to share things you wouldn’t want sitting around in someone else’s database. ## Privacy by Design, Not by Policy Today, most AI privacy still depends on trust. Trust the company not to read your chats. Trust that your conversations won’t be used in ways you didn’t expect. Trust that deletion works the way you assume it does. Trust that the policy won’t change later. Some companies may take those responsibilities seriously. But from our experience building privacy infrastructure, we know that promises aren’t the same as protection. A policy can change. A setting can be missed. A server can be breached. A company can be required to turn over data it has access to. That is the core problem. If a company can read your conversations, then your privacy ultimately depends on that company *choosing* not to. We wanted a different model. Fidaro is built around privacy *by design*, not privacy by policy. That means the product is designed so we cannot see your conversations, even if we wanted to. Not because we have made a promise not to look. Because we simply don’t have access to the plain text of your conversations in the first place. That’s the kind of privacy model we think AI needs. So that’s what we set out to build. ## What We Built We built Fidaro around one basic idea: you should be able to use AI without handing over your private thoughts. When you send a message on Fidaro, it is encrypted on your device before it ever leaves your browser. Our servers pass along encrypted data, but they can’t read what it says. When your message needs to be processed by AI, it is decrypted only inside a Trusted Execution Environment, or TEE. A TEE is a hardware-isolated environment designed to keep data sealed off while it is being processed. In plain English, it gives the AI a protected place to work with your message without exposing that message to the rest of the system, including Fidaro. The result is simple: - Your message is encrypted before it leaves your device. - Fidaro’s servers pass along encrypted data, but cannot read it. - AI processing happens inside a protected hardware environment. - Our team cannot log in and browse your conversations. - Your conversations are not available to us in plain text. - Fidaro is built so we cannot see your data, even if we wanted to. You can read more on our [How It Works](https://fidaro.ai/how-it-works/) page. The important point is the design principle: privacy shouldn’t be something you have to find in settings or hope is enforced by policy. It should be built into the product from the beginning. ## Opening Fidaro in Beta Today, we’re opening Fidaro in beta. It is still early. The product will improve, the models will get better, and the experience will become simpler. We are sharing it now because the core idea is already in place, and because we want to learn from people who care about using AI more privately. During beta, we want to understand where Fidaro is already useful, where it still feels rough, and what people need before they can rely on private AI more often. The product will change quickly. The principle will not. People shouldn’t have to choose between useful AI and private AI. They shouldn’t have to hold back from asking real questions because they are unsure where their words will end up. They shouldn’t need to become security experts just to feel comfortable using a tool that is supposed to help them think. We started Fidaro because we saw AI becoming one of the most personal technologies people use, and because of our background, we couldn’t look at that and accept the usual privacy model. We wanted AI that was useful enough to think with, but private enough to use honestly. AI for the real questions, not just the safe ones. That is what we are building. [Try Fidaro now →](https://app.fidaro.ai) ## Legal ### Privacy Policy (https://fidaro.ai/privacy-policy/) *Last updated: 18 June 2026* ## How Fidaro protects your privacy No one can see your conversations with the AI, not us, not network or servers operators, not governments, not hackers. Your data is yours only, now and forever. - Your conversation is private between your device and the AI. Everything in between, including our own systems, can only see encrypted data. [See how Fidaro works](/how-it-works/). - The AI systems run inside a hardware-enforced secure environment, which ensures your conversations cannot be seen by anyone–even by Fidaro. - We do not log your prompts or responses, sell your personal information, share it for advertising, or build advertising profiles from what you say. - We use open weight LLMs, running on our own hardware. The creators of the AI models never see any of your information, and therefore are unable to ever train on your data. - We collect only the account, billing, support, and anonymous analytics that we need to operate and improve Fidaro. ## Who we are Fidaro (“Fidaro,” “we,” “us”) is the service described in this policy. ## What Fidaro cannot see or use - We do not have readable access to your saved conversation history. It is only stored encrypted, and is decrypted with keys that live on your own device. - We do not write your prompts or responses to server logs or analytics tools. - We do not use your conversations to train models. - We do not have the technical means to tie your identity to readable conversation content. Your account links to your conversations so you can return to them, but only as encrypted data we cannot open. Because the keys are only held by you, your identity and readable words meet only on your own device. - We do not sell your personal information, share it for advertising, or build advertising profiles from your conversations. This also limits what Fidaro can produce in response to a legal request. We can only provide data we actually have. Saved conversations are stored as encrypted data, and we do not have the keys needed to read them. ## Information we do collect Fidaro still needs some information to run the product, manage accounts, process payments, provide support, and understand basic product usage. We try to keep this information minimal, anonymous where possible, and separate from the content of your conversations. - Account information. Your email address, sign-in method, and subscription tier. We use this to create your account, let you sign in, and provide the service. - Encrypted conversations. We store your conversations so you can return to them, but we store them only as encrypted data. We do not hold the keys needed to read your saved conversation history. - Limited product analytics. We collect limited product signals such as features used, model selected, and response latency. These analytics are tied only to a one-way hashed identifier, such that the analytics are not associated with your email address. We see broad product usage patterns, but not which user generated a particular analytics record. - Anonymous operational metrics. To understand broad ways Fidaro is used and improve the quality of our service, software inside the secure enclave collects anonymous operational metrics to help us understand how the system is performing. This may include throughput, resource utilization and high-level conversation categories (e.g. news, travel). Only aggregate counts leave the enclave, which contain no personal data and can not be linked back to you. - Email and reminder preferences. We use your email for account and security messages. If we send product news or reminders, we may use information about your account to help determine what communications to send. - Billing status. Our billing providers help process subscriptions. We receive the subscription and payment status needed to run your account. - Support messages. If you contact us, we will receive what you send us. Support messages are separate from your encrypted Fidaro conversations. - Website and referral data. We use cookies or browser storage needed to sign you in, run the product, understand basic product usage, credit referrals or affiliates when you arrive through those links, and measure which advertising brought you to our site. ## Who else helps us run Fidaro We use a small number of providers, each for a limited job: - Vercel & Supabase host the web app, account records and encrypted conversation data. - Phala / Intel TDX provides the secure enclave used to process conversations. - PostHog helps with product analytics, served through our own domain. - Klaviyo sends account, product, and reminder emails. - Chargebee and payment providers help with subscription billing and payments. Each provider receives only what it needs for its role. Your conversation content remains encrypted at rest and is readable only inside the secure enclave for processing. ## Cookies and tracking We use cookies and browser storage needed to sign you in and operate the Fidaro app. We also use privacy-respecting product analytics served through our own domain, referral or affiliate cookies when needed to credit a referral, and advertising measurement cookies that tell us which of our ads brought you here. Those advertising cookies only ever see pages you visit on this website; they have no access to the Fidaro app. ## Changes, contact, and account requests We may update this policy as Fidaro changes. The latest version will be posted with the date above. For privacy questions or account requests, contact us at support@fidaro.ai. We will do our best to help based on the information we actually have and how Fidaro is technically designed. Because Fidaro is designed so that we cannot read your saved conversations, requests about your account do not give us access to their contents. ### Terms of Service (https://fidaro.ai/terms-of-service/) *Last updated: 17 June 2026* These Terms explain the basic rules for using Fidaro. By using Fidaro, you agree to them. These Terms include our [Privacy Policy](/privacy-policy), which explains what information Fidaro collects, what we do not collect, and how Fidaro is designed to protect your conversations. ## Fidaro Fidaro provides private AI conversations and related services. The product may change over time as we add, remove, or improve features. You must be at least 18 years old to use Fidaro. You are responsible for keeping your account, device, sign-in method, and recovery phrase secure. ## Using Fidaro responsibly You agree to use Fidaro lawfully and responsibly. You must not use Fidaro to break the law, violate someone else’s rights, harm or deceive others, interfere with Fidaro’s systems, access accounts or systems without permission, upload content you do not have the right to use, or bypass Fidaro’s security measures or technical safeguards. We may suspend or limit access if we believe an account is being misused, creates risk for Fidaro or others, or violates these Terms. ## Your content You own the information you submit through Fidaro. We do not claim ownership over your prompts, responses, or saved conversations. You give Fidaro only the rights needed to provide, secure, operate, and improve the service, as described in these Terms and the Privacy Policy. Because Fidaro is designed so that we cannot read your saved conversations, we cannot review, monitor, or recover their contents for you. ## Our service Fidaro and its software, design, systems, branding, and other service materials belong to Fidaro or its licensors. We give you a limited, personal, non-transferable right to use Fidaro in accordance with these Terms. You may not copy, resell, reverse engineer, or misuse Fidaro except where the law allows. ## AI outputs Fidaro uses AI systems, and AI outputs may be inaccurate, incomplete, or unsuitable for your situation. You are responsible for how you use Fidaro’s outputs. Fidaro is not a substitute for professional advice, including legal, medical, financial, tax, or other specialist advice. ## Payments Some Fidaro features may require payment. If you choose a paid plan, the price, billing cycle, and payment terms will be shown at checkout or in your account. Payments may be handled by third-party billing providers. We may change prices or plans over time. ## Availability We try to keep Fidaro available and working well, but we do not promise that the service will always be available, secure, error-free, or uninterrupted. Fidaro may be unavailable because of maintenance, upgrades, outages, security issues, provider failures, or other reasons. ## Disclaimers and limits Fidaro is provided “as is” and “as available.” To the extent permitted by law, we make no warranties about Fidaro, including warranties of accuracy, reliability, availability, fitness for a particular purpose, or non-infringement. To the extent permitted by law, Fidaro will not be liable for indirect, incidental, special, consequential, exemplary, or punitive damages, or for lost profits, lost data, lost business, or loss of goodwill. To the extent permitted by law, Fidaro’s total liability for any claim relating to the service will not exceed the amount you paid to Fidaro in the 12 months before the claim arose. ## Ending access You may stop using Fidaro at any time. We may suspend or end your access if you violate these Terms, misuse the service, create risk for Fidaro or others, or if we stop offering the service. ## Changes and contact We may update these Terms as Fidaro changes. The latest version will be posted with the date above. For questions about these Terms, contact us at support@fidaro.ai.