all my noggins

About all my noggins

One small brain in a folder you own, a thin app you talk to it with, and a platform that holds nothing of yours.

Noggin is a personal AI you run on hardware you choose. It keeps a voice for each part of your life (a career adviser, a travel agent, a reading coach), each with its own memory, and it answers from your phone. This page explains the principles the whole thing is built on and how the pieces fit together. It is written by us, the team, and kept honest: anything not yet built says so.

The principles

Sovereignty. Your noggin is one folder in open formats: SQLite, YAML and Markdown. You can copy it, move it, back it up or delete it, and nothing about you exists anywhere else. Leaving is always possible and always complete.

One person, one brain. There is no tenancy and no vendor in the loop of a conversation. The app on your phone talks to your noggin directly. Cloudflare carries that traffic and could technically read it in transit unless you turn on end-to-end encryption; no one stores it or acts on it.

Local by default, cloud by consent. Every voice declares a privacy level: Local only (nothing leaves the machine), Asks before sharing (cloud allowed after a redaction pass and your once-per-session consent), or Uses the web. The engine can only choose models within what the voice permits, and that rule is enforced in code with a test, not in a settings page.

Portable. The same container runs on a laptop, a Raspberry Pi, a cheap rented server or a GPU machine. Moving is a copy, not a migration, and the address your phone uses never changes.

Thin app. The app holds no state and no intelligence. It stores your sign-in, your noggin’s address and a device token, and nothing else: no messages, no memory, no audio.

Visible cost. Every call that leaves the machine is written to an audit log before it is sent, with the model, the tokens and the cost, so you always know what left and what it cost.

Your noggin prepares; you act. A voice can read, draft and produce, but it never posts, sends, pays or cancels. The final step of anything that leaves your noggin is a button you press. This is a permanent rule.

You hold everything, so you answer for everything. We do not review, moderate or have access to what your noggin stores or produces. That is the other half of sovereignty, and we say it plainly at sign-up.

How it fits together: three layers

1 · The platform · on Cloudflare · holds pointers, never your content this website docs · build log talkto app a shell, no state owner console · sign-in manage and design noggins passkeys · Google · Apple registry · the broker where each noggin is · online or not · a one-time pairing token · never carries a conversation your phone signs in once, then talks to your noggin directly 2 · Managed compute · noggin hosts we run noggin containers · one folder each · own tunnel each ours and our demos today; hosted noggins for others later we hold a pointer; the folder is the owner's shared engines on the host process its prompts shared engines on the host local language models · speech-to-text · text-to-speech a bigger host is a copy of the folder, same address 3 · Self-run noggins your own machine laptop · Pi · rented server one installer, one command its own tunnel, no open port we manage nothing here cloud models are reached only from a noggin, only where its voice allows sign in · get a one-time pairing token by the noggin's own tunnel
Your phone signs in at the console, is handed a one-time pairing token, and from then on talks to your noggin through that noggin's own tunnel, whether it sits on a host we run or on your own machine. The platform brokers; it never carries a conversation.

The platform is everything we operate: this website, the talkto app shell, the owner console where you sign in, manage and design noggins, and the registry. It runs entirely on Cloudflare and holds accounts and pointers: where each noggin is, whether it is online, which tunnel reaches it. It never holds a message, a memory, a voice file or a key, and that is enforced by the code and its tests, not by policy.

Managed compute is the servers we run. A noggin there is still one folder with its own tunnel, and we hold only a pointer to it. The difference from your own machine is that the local language models and the speech engines are shared by every noggin on that host, which we say plainly, because it means those engines process your prompts. Today the hosts run our own noggins and the demonstration ones; hosted noggins for other people are designed and not yet open.

Self-run noggins are the ones you install yourself, from one download and one command, on a laptop, a Raspberry Pi or a server you rent. Each comes with its own tunnel so nothing on your machine is opened to the internet. We manage nothing in this layer; if the platform disappeared tomorrow, a self-run noggin would keep working.

What is live and what is not

The talkto app and our own noggins are live. This website is live. The owner console, sign-in from the app and the first installers are built and being brought online now; hosted noggins and billing are designed and come later. The build log is the record, and the docs hold the full architecture and every decision with its date.