Why private means a box on your desk

You know the moment. You have a file open. AI could help with it. You copy it. Then you stop before you paste.

That pause is why we wrote this. It comes in two kinds.

What you may not share

Some of what you work with is not yours. Someone gave it to you in trust. A patient's chart. A client's contract. A student's grades.

Here the question is not how you feel. It is what you may do. Your job or your client may set rules on where it can go. Some cloud AI plans can follow those rules, if you pay for the right plan and sign the right contract [1]. The Box asks something else. Do you want it to leave your office at all?

When we talk to people who want a Box, this is the reason we hear most. Mike, one of our co-founders, felt it in our own business: "it's not right to put extensive client data that people have trusted us with …"

What you would rather keep to yourself

The second kind is yours. No rule says you can't share it. You still stop. Your journal. Your test results. Your email.

Mike put it as "this cringe feeling and this big hesitation". He had a health problem. He wanted AI to look at his test results with him. He did not do it. He "didn't have confidence in where the data was going."

That pause is fair. Here is why.

Where your words go in cloud AI

When you type into a cloud AI, your words go over the internet. They land on a machine the company uses. They are kept there, at least for a while. Here is what OpenAI, Anthropic and Google say, and what courts have done, as of September 2026. Rules change, so check what they say now.

They may learn from your chats. This is called training. The company uses your chats to teach its next AI. Unless you turn it off, OpenAI may use your ChatGPT chats this way. Even then, if you click thumbs up or down, the whole chat may be used [2]. Anthropic lets people on its Free, Pro and Max plans choose. If they say yes, their new chats are kept for five years, not 30 days. That goes for old chats they pick up again, too [3]. Business plans have other rules [2][3].

People may read them. Google has real people read some Gemini chats. Some of them work for other companies. Those chats stay even if you delete them, for up to three years. Google's own advice: "Please don't enter confidential information that you wouldn't want a reviewer to see." Work and school accounts may have other rules [4].

A court can make them keep your chats. The New York Times took OpenAI to court. In May 2025, a judge in that case told OpenAI to keep ChatGPT chats, even chats people chose to delete. In late September 2025, that order stopped for new chats. But chats from before then were still kept. So were chats from some accounts the Times had pointed out. And the Times could add more [5].

A court can make them hand chats over. In that same case, a judge told OpenAI to give 20 million ChatGPT chats to the side that sued. Names and other facts about who wrote them were taken out first. A higher judge agreed in January 2026 [6]. Sam Altman, the head of OpenAI, said it himself in July 2025. He said that what you tell a doctor or lawyer is protected by law. For ChatGPT, he said, "we haven't figured that out yet" [7].

None of this means these AI are bad. Many are very good. But once your words are on a machine you don't own, their rules decide the rest. Sometimes a court does. You can change some of it. You can't make the call.

What the Box does instead

The Box is a small computer with the AI inside it. It is on your desk, on your home or office network. You type on your laptop or phone. Your words go to the Box, and they stop there. (A few extras you can turn on do send words out. See below.)

• Your chats stay on the Box. We have no copy. We can't read them unless you let us in for a help session.
• Your chats don't train any AI. The Box has no setting that sends them to us or anyone else to learn from. (Web search does send your search words out. See below.)
• We can't hand over chats we don't have. A court can still ask you for them, like any file you keep.
• You can wipe it. Use the reset on the settings page of the Box. It wipes your chats, memory, settings, passphrase and linked accounts. Then you set it up again from the start. We can't bring any of it back, because we never had it.

If your internet goes down, the AI keeps working. Your laptop just has to be on the same network as the Box.

So both kinds get the same answer. The patient's chart and your journal go to the same place: a box you can see, in a room you control.

What the Box can't do

This is not magic. We would rather you hear what it can't do from us.

Your files on the Box are not locked in code. Some machines mix up what they store, so a thief would see junk. This is called encryption. The Box doesn't do this. Your passphrase keeps people out when they use the Box the normal way. But a thief who is good with computer stuff could read the drive. A reset will wipe your files, but a pro might still get some back. So keep the Box in a safe place.

It does talk to the internet a little.

• Once a day, the Box asks our server, "Is there a new version?" It only gives the version it has. No name, no box ID, no chats.
• Cloudflare sends out each new version for us. It can see your internet address when the Box asks. That record is kept for 30 days. We use it only to fix trouble with sending new versions [8].
• You can turn this daily check off in Settings > Updates.
• A report once a week is off unless you turn it on. In it: the version, which Box you have, your country, and how long the Box has been on. It also has a random ID. The ID changes if you turn the report off and on [8].
• Like any computer, the Box also gets the time and asks where web sites are.
• No update goes on the Box unless you say yes.

Some extras send words out. Each one is off until you turn it on.

• Web search. Your search words go to a search service. Each web page the Box goes to can see your internet address.
• Signal, an app for texts. You can text the Box from your phone. Your texts are locked, so Signal can't read them [8].
• Tailscale, an app to reach the Box when you are away from home. What you send is locked the whole way, so Tailscale can't read it [8][9].
• A help session. If you ask us for help, you can let our tech person into your Box. It lasts four hours at most. You start it. A sign is on the screen the whole time. You can end it any time.

You can turn each one off again any time.

Owning the Box doesn't mean you follow the rules. If you handle health, law or money files, those rules are still yours to follow. The Box keeps your files in your office. It does not prove you follow the rules, and this is not legal advice. And don't take what the AI says as the word of a doctor or lawyer. Check its work.

So, can you finally paste it?

That's the goal. Not to be less careful. The goal is to stop having to pick: get help, or keep it to yourself.

In the words of Asha, our other co-founder: "If you are always concerned with privacy, the AI gets nerfed." In other words, it can't do much, because you can't give it your real work. With the AI on your desk, that file you copy is just the next thing you ask about.

The Box is set up before we ship it. You plug it in, join it to your network, and start. You get two weeks of help to get started, Monday to Friday, 9 to 5 Eastern. You also get a full year of help to fix trouble with the Box. You book both ahead of time.

See pricing and the next batch
Read what owning your AI means
Read the case for paying once
Read the full privacy policy

---

Sources

1. Cloud services can hold regulated health data under a business associate agreement; a cloud provider that creates, receives, maintains, or transmits ePHI is a business associate and the covered entity "must enter into" a BAA with it — https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html (HHS, "Guidance on HIPAA & Cloud Computing"; direct fetch returns 403, read via reader proxy). Used only to support "some cloud AI plans can follow those rules, if you pay for the right plan and sign the right contract."
2. OpenAI: "When you use our services for individuals, such as ChatGPT and Codex, we may use your content to train our models"; opt out by turning off "Improve the model for everyone" under Settings > Data controls (i.e. on until you turn it off); "If you choose to provide feedback, the entire conversation associated with that feedback may be used to train our models" (even after opting out, e.g. thumbs up/down); temporary chats are not used; "By default, we don't use inputs or outputs from ChatGPT Business, ChatGPT Enterprise, ChatGPT Edu, or our API to improve our models" — https://help.openai.com/en/articles/5722486-how-your-data-is-used-to-improve-model-performance (re-opened 2026-09-28 via reader proxy; direct fetch 403)
3. Anthropic consumer terms update: "Claude Free, Pro, and Max plans, including when they use Claude Code"; applies to "new or resumed chats and coding sessions"; 5-year retention if allowed, 30 days if not; Commercial Terms (Claude for Work, Government, Education) and API excluded; Oct 8, 2025 deadline — https://www.anthropic.com/news/updates-to-our-consumer-terms (re-opened 2026-09-28)
4. Google Gemini Apps Privacy Hub: "Human reviewers (including trained reviewers from our service providers) review some of the data we collect"; reviewed chats "are not deleted when you delete your activity. Instead, they are retained for up to three years"; "Please don't enter confidential information that you wouldn't want a reviewer to see or Google to use to improve our services"; "If you have a work or school Google Account, your use of Gemini Apps may be subject to different data handling terms." — https://support.google.com/gemini/answer/13594961 (re-opened 2026-09-28)
5. NYT v. OpenAI: "The case kicked off in late 2023, with the New York Times suing OpenAI"; preservation order May 2025; OpenAI "no longer has to preserve chat logs as of September 26, except for some"; logs "already saved under the previous order would still be accessible"; OpenAI must keep data for accounts flagged by the NYT, and "the NYT is allowed to expand the number of flagged users" — https://www.engadget.com/ai/openai-no-longer-has-to-preserve-all-of-its-chatgpt-data-with-some-exceptions-192422093.html (re-opened 2026-09-28; also https://simonwillison.net/2025/Oct/23/openai-no-longer-has-to-preserve/)
6. OpenAI must "produce 20 million de-identified ChatGPT logs to both news plaintiffs and class plaintiffs"; District Judge Sidney Stein affirmed the magistrate judge's order on January 5, 2026; de-identification removes personally identifiable information — https://natlawreview.com/article/openai-loses-privacy-gambit-20-million-chatgpt-logs-likely-headed-copyright (re-opened 2026-09-28) and https://news.bloomberglaw.com/ip-law/openai-must-turn-over-20-million-chatgpt-logs-judge-affirms
7. Sam Altman, This Past Weekend with Theo Von, July 2025: "if you talk to a therapist or a lawyer or a doctor about those problems, there's legal privilege for it"; "we haven't figured that out yet for when you talk to ChatGPT" — https://techcrunch.com/2025/07/25/sam-altman-warns-theres-no-legal-confidentiality-when-using-chatgpt-as-a-therapist (re-opened 2026-09-28)
8. Box network behavior: daily version check to our update server sending only the version (User-Agent), no box identifier; CDN edge logs IP + path for 30 days, "used only for delivery troubleshooting"; toggle in Settings > Updates; opt-in weekly report (version, hardware tier, country, uptime, random ID that "rotates every time you toggle this setting off and back on"); OS housekeeping (time sync, DNS, packages only after you approve an update); Signal end-to-end encrypted, "Signal can't read your messages"; Tailscale "does not see your actual traffic"; Cloudflare as processor — internal: twenty/legal/md/privacy-policy--web.md §2, §3, processors list (line 86); published as /privacy on the site. Web search and help sessions are not in the policy, so [8] is cited only on Signal, Tailscale and the update/report bullets.
9. Tailscale connection types: "All three options are end-to-end encrypted with WireGuard" (direct, DERP relayed, peer relay) — https://tailscale.com/kb/1257/connection-types (opened 2026-09-28)

Internal:

• No encryption at rest; access control only — company-profile/README.md "Contractual guardrails"; company-profile/legal.md "Guardrails"; product.md "Setup and updates"
• Factory reset: on-box "Factory reset…" button on the settings (admin) page — halo-onboard/halo_onboard/admin/templates/admin.html:102; confirm page says "You'll re-do the 3-step setup" and "This cannot be undone" — admin_factory_reset_confirm.html:23-25. Scope (wipes wizard.json, provisioning.json incl. passphrase hash + device tokens, on-box backups + keystore, Signal data, Hermes config/connections/memories/Mnemosyne/sessions; keeps models, box-id, country, certs; uses rm) — halo-onboard/scripts/factory-reset.sh header and line 54
• Power-button gesture is five presses in ten seconds, not a 15-second hold, and is deliberately not advertised — halo-onboard/scripts/reset_button_watcher.py:1-29, 68-69
• Setup before shipping; onboarding "at least two weeks", 9–5 Eastern, Mon–Fri, by appointment; 12 months of help with "technical problems with the box", by appointment — twenty/legal/md/terms-of-sale.md §4; company-profile/current-facts.md "Support"
• Box outputs are not professional advice — twenty/legal/md/terms-of-sale.md §9
• Web search off by default, opt-in; gate also governs web_extract — halo-onboard/docker/hermes-patches/ddgs-init-gated.py docstring (commit 7dea894)
• Help session: customer taps "Allow support", 6-digit code, box joins the support tailnet for up to 4 hours, active-session banner and "Revoke now" — halo-onboard/halo_onboard/support/__init__.py docstring
• Offline operation — site FAQ, src/components/redesign/faq.tsx ("Does my data actually stay on the box?")
• "The reason we hear most" — docs/our-story-interview.md, "From the sales-call notes", theme 1 is listed first of five, "most-mentioned first"
• Mike quotes — docs/our-story-interview.md Q3 (intro line, Medical, Customer data)
• Asha: "If you are always concerned with privacy, the AI gets nerfed." — docs/our-story-interview.md, "Lines from us, already said on calls"
• Framing, two kinds of private, example lists, link text — docs/copy-ideas.md §2a Version A