NOAI

Inspiration

A personal assistant is only useful if it knows your life: your doctor, your bank, your family, your contracts. Today that means handing all of it to someone else's model and trusting a privacy policy. You cannot see what was sent, and you cannot prove it afterwards. We wanted a personal AI that is useful without being handed your life, and that can prove what it disclosed. The name says it: NOAI, pronounced No Eye.

What it does

NOAI answers questions about your private notes.

• Your notes live in an encrypted vault in your browser (AES-256-GCM, key derived from your passphrase with scrypt). The passphrase is never stored and there is no server holding the vault.
• When you ask, NOAI ranks your notes on your device and picks only the few passages it needs.
• Before anything is sent, phone numbers, emails, IBANs, card numbers, IP addresses and API keys are replaced with placeholders like [PHONE_1].
• NVIDIA Nemotron 3 Super on Nebius Token Factory answers from that. Your device puts the real values back.
• Every disclosure gets a receipt, signed on your device with Ed25519 and chained with SHA-256. A live receipt tape shows exactly what the model saw. Press "Tamper with the log" or "Delete a receipt" and the chain breaks at the exact entry.

It is a real assistant, not only a Q&A box:

• Persistent memory: "remember that..." is sealed straight into the vault and sends 0 bytes.
• Reusable skills: draft a message, set a reminder, summarise a bill. They run through the same redaction and receipts.
• Reminders are sealed with their due date and listed in the vault.
• If Nemotron 3 Super does not answer in time, the same redacted passages go once to Nemotron 3 Nano, and both attempts are receipted.

How we built it

• Browser app with no framework and no third-party code at runtime. The page runs under a strict Content Security Policy: no CDN, no external scripts, no connections except its own origin.
• On-device retrieval: BM25 fused with all-MiniLM-L6-v2 running as WebAssembly in the tab. The model file is checked against a pinned SHA-256 before it runs. "Who is my doctor?" finds a note that says "GP", which keyword search alone misses.
• The egress gate is the only file allowed to use the network, and a test fails the build if any other file tries.
• A browser cannot hold an API key, so a small relay (one short file, deployed as a Netlify function) adds the Nebius key and forwards the exact bytes. It only accepts NOAI's own system prompt with an allowlisted Nemotron model and a size ceiling, so the key cannot be borrowed as a general model proxy, and it logs nothing.
• Nebius Token Factory's OpenAI-compatible API meant no SDK: one fetch in one auditable file.
• The same core runs on the desktop as a Node CLI and local server, and receipts from the browser verify with the desktop verifier.
• 59 automated tests, none using the network: the model is replaced by a stand-in that records the exact bytes it would have received.

Challenges we ran into

• Reasoning tokens: at small budgets a reasoning model can spend everything thinking and return raw thinking as the answer. We treat finish_reason "length" as a failure and never show it.
• Honest redaction: a live test found that digit dates like 2026-10-12 were being replaced as phone numbers, so the model was asked for a date it had been given. We fixed it and added a test.
• Proving limits, not only features: we wrote tests that prove what NOAI does not hide (names, dates and free text are sent as written) so our claims stay accurate.
• Windows Smart App Control blocks unsigned native binaries, so every piece had to be pure JavaScript or WebAssembly, which is also why the same code runs in the browser.

Accomplishments that we're proud of

• The model answers correctly while the real phone number, IBAN or card never leaves the browser, and the page shows you the exact bytes it sent.
• A receipt chain anyone can verify offline, with no account and no vault.
• A privacy test report that marks each claim proven or not proven, including the limits.

What we learned

Minimal disclosure is a product decision, not a setting. The unit of retrieval is the unit of disclosure, so small passages matter. Nemotron 3 Super respects placeholders: it used [PHONE_1] verbatim and never guessed the value, which is what makes on-device rehydration work.

What's next for NOAI

• Recognise names on the device too, so they can be replaced like phone numbers.
• Conditional release: sealed documents that open for a chosen person only when a condition is met, without the service ever holding the document or its key.
• A self-hosted deployment, and an independent security review.

Built With

• indexeddb
• javascript
• nebius-token-factory
• netlify
• node.js
• nvidia-nemotron
• onnxruntime-web
• typescript
• webassembly
• webcrypto