In Private mode — the default — your assistant, your memory, and your documents live on the device and nowhere else. You don’t have to take our word for it. You can watch the wire yourself.
One device boundary. Everything that makes the assistant work lives inside it. Exactly one path ever crosses it — Boosted — and only when you ask for it, with your own key.
Privacy you can check beats privacy you’re promised. The device ships with a live view of its own network.
A running list of the device’s outbound connections, each next to the service that owns it. From the terminal: phntm privacy.
The strongest privacy claim is one the owner can confirm. Cross-check it against the raw truth with sudo tcpdump -i any.
In Private mode the honest answer is: nothing leaving for the model at all. Updates and Boosted are the only things that ever reach out, and only when you start them.
PHNTM One can optionally connect to a couple of outside services. Each is off until you deliberately configure it, and each is yours, not ours.
You can mirror alerts and chat to Telegram if you want the assistant in your pocket outside your network. Off unless you connect it; when on, those messages travel through Telegram like any other.
The assistant can work with email if you choose to set it up with your own account. Off by default; it never reads or sends mail you didn’t configure.
One command hands you your data to keep or move. Your assistant’s memory is yours to take with you.
Debian Linux, with SSH documented and never removed. You can read every line it runs; you never need a terminal for normal use.
Owner-initiated updates roll themselves back if a self-test fails, and the device is built to be restored — nothing changes underneath you.
Own the hardware, read the code, watch the wire.
$549 · one-time · no subscription · ships within 7–10 business days after payment