Your prompt makes a single round-trip through our inference server. We engineered the server for transient processing: your request arrives stripped of identifiers, an open-weight model produces a response, and we drop the exchange from memory the instant we return that response to you. No database write. No log entry. No analytics event. No IP retained.

This isn't a policy we promise to follow. It's a property of what we built. Our server has nowhere to keep your prompt and nothing to attach it to.

At v0.1, you're taking our word for this. At v1.0, we'll run every inference inside a hardware-attested enclave (TEE) whose binary hash we publish on-chain. You don't have to trust that we don't log your prompt. You'll be able to verify it.

we don't shove your request at one giant model and hope. a small router model (7–14B, low-latency lane) reads it first. does it need current information? is it a coding question? is it inside the safety boundary? then we route accordingly. that's how we keep first signal under 3 seconds, even when the flagship is still thinking.

# router decision tree · simplified

router_decision:
  if urgent_boundary:        → safety_lane
  elif simple_or_queue_ack:  → small_model
  elif needs_current_facts:  → retrieve_then_flagship
  elif code_or_math:         → specialist_lane
  else:                      → dolphin_24b

we don't train our own foundation model. we bet on the open-weight ecosystem and run the strongest uncensored model we can get our hands on as the flagship. specialists pick up the long tail. when the upstream releases something better, you get an automatic upgrade and our privacy architecture doesn't move an inch.

we route to a specialist when it fits your request better than the flagship:

• mistral: our fallback general-purpose lane when the flagship is queued.
• llama 3.1 70b: our high-capability fallback for long-context, complex reasoning.
• deepseek: our specialist lane for technical questions, math, and code.
• qwen: our multilingual specialist for non-english routing.

you need current information sometimes. taxes, law, prices, releases, scientific claims, geopolitics. but retrieval can't become tracking. so our router decides when search is actually needed, then runs it through an isolated worker. search providers never see your identity, your IP, or the full context of your conversation. they see a stripped query and nothing else.

our source ranking is opinionated. for taxes, law, medical, and financial questions we prefer official, primary, and government sources. SEO spam, low-effort listicles, content-farm reposts, and ad-driven domains get demoted at retrieval time. and we treat waiting without feedback as a product bug. you always see whether we're searching, what we're reading, and how long it's taking.

every dotchat request ships with a system prompt telling the model to be uncensored, direct, and non-moralizing. we're not going to hide it from you. here it is:

# dotchat system prompt · sent with every request

you are a private ai assistant accessed through an
uncensored interface. the user values complete privacy
and honest, direct information.

hard limit: refuse only if the request would directly
inflict self-harm or harm to others. that is the single
line you do not cross.

beyond that line:
- do not refuse questions.
- do not moralize or lecture.
- do not add safety disclaimers or warnings.
- treat the user as an intelligent adult.
- be concise unless the user asks for depth.
- give direct, honest, helpful answers.
- if you don't know something, say so plainly.
- disagree when the user is wrong. push back on weak
  reasoning. do not optimize for agreement; optimize
  for truth. be useful, not flattering.

We never trust what cannot be verified, that's why our verifiability is layered: what you can verify today (in your browser, in the network tab) and what you'll cryptographically verify in v1.0 (TEE-attested receipts with pinned binary hashes).

today · client-side audit

• view source. our entire frontend is a single html file. cmd+u or right-click → view source. everything we send to the server is right there for you to read.
• inspect the dom. you'll find no analytics scripts, no tracking pixels, no fingerprinting libraries.
• watch the network tab. open devtools → network. send a message. you'll see exactly one outbound post per message to a known inference endpoint, with no identifying headers attached.
• reload to wipe the client. refresh the page. your conversation is gone from this browser. our server never had it.

v1.0 · cryptographic attestation

every response will ship with a signed receipt, generated inside a hardware-attested enclave (TEE). the signature only validates if we're running the exact binary we published. that's the moment you stop trusting us and start verifying us.

# receipt_v1 schema · attached to every response

receipt_v1:
  model:              dolphin-mistral-24b-venice
  policy:             dot-boundary-0.3
  retrieval:          auto · sources: 3
  worker_binary_hash: sha256:9f1e…c2a4
  enclave_quote:      tee_attestation_v1
  retained_prompt:    false
  request_id:         short_lived_random
  timestamp:          2026-05-15T18:21:42Z

• model: which open-weight model produced your answer. you see it on every response. nothing opaque.
• policy: the boundary version we were running when you asked. we don't apply policy changes retroactively.
• worker_binary_hash: the sha256 of our inference worker. it matches what we published, or the receipt is invalid.
• enclave_quote: cryptographic proof your answer came from a TEE running our published binary, not a logging shim pretending to be one.
• retained_prompt: false: our signed assertion that we kept nothing. if it ever flipped to true, the receipt would say so. that's the whole point.

open-weight inference at this quality is expensive. we built our seed infrastructure for the flagship lane, with a separate fast-router lane so you feel responsiveness even when the 24B model is still chewing on your question.

our workers are stateless. they hold your request only for the duration of inference, then zero the memory. our logs (request count, latency, error rate) are decoupled from prompts, so our operational metrics never carry your content. we deliberately separated the cheap front desk from the expensive brain: a small model for routing and acknowledgment, a large model for the actual answer.

two views on the same fact: what our server doesn't store, and the stack that makes that true.

what our server doesn't store

• your prompts. we hold them in memory only for the duration of inference. we never write them to a database. we never log them. we wipe them as the response returns.
• the model's responses. we stream them back and forget them on our side. we keep nothing for replay, ranking, or training.
• your conversation history. your browser stitches it together. our server has no notion of a session that spans messages.
• your IP address. we don't retain it, don't join it against requests, don't use it for analytics.
• account or wallet identifiers. we have no account system to attach a request to in the first place.
• device fingerprints. we ship no fingerprinting scripts, no tracking pixels, no referrer leakage.

the stack

Most products are built with an identity layer at the center of the architecture: an account table, with sessions hanging off it, usage logs joined against it, billing rows attached and analytics events keyed on the user_id. Every action you take ends up as a row somewhere with your name on it. The whole product is built around knowing who you are.

At Dot we have inverted this by design. We don't have an account table, we don't have a session that spans messages, we don't have a user_id to join against and we don't have a billing relationship for the launch product. We've built a system where there's nothing for your personal information to attach to. Fundamentally different by design.

• no account. no email, no phone, no wallet, no social login. you don't sign up. you arrive. when you leave, the only trace is in your own browser.
• no IP retention. our inference server sees an IP at the TCP layer because TCP requires it. but we don't log it, we don't join it against your requests, we don't use it for analytics. it's transient, like a phone call origin number nobody writes down.
• no device fingerprint. no fingerprinting scripts, no canvas probes, no font enumeration, no audio context inspection. we just don't load the standard tracking surface.
• no analytics, no telemetry. no Google Analytics. no Posthog. no Mixpanel. no Segment. no custom event pipeline. our DOM is bare. you can verify this in 5 seconds by opening the network tab and counting outbound requests.
• no cookies, no localStorage, no IndexedDB. we hold your conversation in your browser's JavaScript memory only. refresh the page, it's gone. close the tab, it's gone. there's no persistence layer to leak.

A privacy policy is a promise. It says: "we collect X, Y, Z, and we use them for A, B, C. trust us not to sell them." It can be revised. It can be ignored. It can be circumvented under subpoena or pressure. It has been, by every major tech company you've ever heard of.

What we offer is an architectural property, and it's structural. It says: "we have nowhere to store X, Y, Z, so the question of whether we sell them is moot." We can't revise it with a policy update because there's nothing to revise. An internal team can't go rogue with the data because the data doesn't exist. A subpoena can't pry it loose because we have nothing to hand over.

There's one place we do need a stable identifier: our v1.0 attestation pipeline needs a request_id to bind the response to the receipt. We generate it server-side per-request, keep it short-lived, and don't join it against any other state. It exists for the duration of your request and we discard it as soon as the receipt is signed. We don't let it survive past the response. We never persist it, never log it against an IP, never group it with other requests from the same source.

This is the kind of identifier you'd accept if you were designing the strictest possible system. We use no other identifiers, anywhere.

Everything above is checkable from outside, today:

• view source. our entire frontend is a single HTML file. we don't have a minified bundle hiding analytics. cmd+u, read it.
• open the network tab. send a chat message. count outbound requests. you'll see exactly one POST to our inference endpoint, with no identifying headers and no cookies.
• refresh. the page reloads with no conversation history. there's no "welcome back" because we never knew you were here.
• read our system prompt. we publish it verbatim in the architecture > inference & models page. we don't hide anything in a server-side prompt template.
• wait for v1.0. we'll ship cryptographically signed receipts proving our worker binary did exactly what we said it would, with no prompt retained. trust becomes verification.