How Marcus keeps your conversations private. Every architectural decision — from how messages leave your device to where they are stored — was made to ensure that no one, not even us, can read what you write.
Most AI chat applications follow a simple pattern: your message is sent to a server, the server forwards it to an AI model, and the response comes back. Along the way, your prompt may be logged, stored, analyzed, or used to train future models. The server operator can read every word. The AI provider can too.
Your most private questions — about health, relationships, finances, fears — become someone else's data.
Marcus eliminates this pattern entirely. We built a zero-knowledge relay architecture where the server that routes your messages is cryptographically prevented from reading them.
Your prompts are encrypted before they leave your device, and only the AI processing endpoint can decrypt them. The server in between is blind.
Marcus employs a four-layer privacy architecture that protects user data at every stage of the communication lifecycle. Each layer operates independently, so a compromise at any single layer does not expose user content.
AES-256-GCM encryption of all message content before transmission
RSA-OAEP key wrapping with per-session ephemeral keys
TLS 1.3 with certificate pinning and HMAC request signing
All chat history stored exclusively on-device via encrypted local storage
For users who want absolute certainty that their prompts never leave their device at all, Marcus offers a fifth layer: on-device AI inference. The Offline Chat mode runs a language model directly on your phone's processor, with zero network activity.
When you send a message in Marcus, the following process occurs entirely on your device before any data is transmitted:
A fresh AES-256-GCM symmetric key is generated using the device's cryptographically secure random number generator. This key is unique to each conversation session, providing forward secrecy.
Each message is individually encrypted using the session key. Every message receives its own randomly generated 96-bit initialization vector (IV), ensuring identical plaintext messages produce entirely different ciphertext.
The session key itself is encrypted using the AI processing endpoint's RSA public key with OAEP and SHA-256. Only the corresponding private key, held exclusively at the AI endpoint, can unwrap it. The relay server cannot decrypt the session key or any messages.
The encrypted messages, their individual IVs, authentication tags, and the wrapped session key are sent as a single payload. The relay server validates structural integrity but cannot interpret the content.
The AI's response is also encrypted before it travels back through the relay server. The entire conversation is opaque to every intermediary.
To be precise about what information the relay server can observe:
| Data Point | Visible? | Explanation |
|---|---|---|
| Message content (prompts) | No | Encrypted with AES-256-GCM |
| AI response content | No | Encrypted with the same session key |
| Which AI model selected | Yes | Required for routing to the correct provider |
| Message count per request | Yes | Structural metadata (number of encrypted blobs) |
| Approximate message size | Yes | Encrypted payload size correlates loosely with plaintext length |
| Timestamp of request | Yes | Standard network metadata |
| Your user identity | Minimal | Authentication token for access control; not linked to content |
Routing metadata is visible because the server must know which AI provider to forward your request to. But the substance of your conversation — every word you type and every word the AI responds with — is cryptographically inaccessible to the server.
For users who require absolute privacy with no network transmission whatsoever, Marcus offers Offline Chat powered by an on-device language model.
The Offline Chat mode runs a quantized version of Google's Gemma language model directly on your device using optimized native inference bindings. When you select Offline Chat mode:
The model runs entirely within your device's memory. Zero network calls are made. Your prompt never leaves the application's process boundary. No telemetry, analytics, or crash reports are sent during offline inference.
The chat screen detects Offline Chat mode and routes requests directly to the on-device inference engine, bypassing the network service layer entirely.
If a Gemma request somehow reaches the network service layer, it is immediately rejected with an error before any network call is constructed.
If an offline model request somehow reaches the server, the server explicitly rejects it and returns an error.
The on-device inference module is architecturally isolated from all networking code. It does not import any HTTP client. It physically cannot make a network request.
All conversation history in Marcus is stored exclusively on your device using the platform's secure local storage. Messages are never uploaded to a cloud database, never synced to a remote server, and never backed up to our infrastructure.
If you delete the app, your conversations are permanently gone. There is no server-side copy to recover. If someone gains access to our servers, they will find zero conversation data — because we never had it.
Marcus provides configurable auto-deletion timers that automatically purge conversations after a user-defined period. Options include 24 hours, 7 days, and 30 days. Pinned conversations are preserved to prevent accidental loss of important threads.
Marcus supports device-level biometric authentication (Face ID, Touch ID, or fingerprint) as an additional access barrier. Even if someone has physical access to your unlocked device, they cannot open Marcus without your biometric confirmation.
All network communication occurs over TLS 1.3. Beyond standard TLS, Marcus implements certificate pinning: the app contains pre-configured cryptographic fingerprints for the server's TLS certificate. If the server presents a certificate that does not match — as would happen in a man-in-the-middle attack — the connection is refused.
Every sensitive API request is signed with an HMAC-SHA256 signature. The signature covers the HTTP method, request path, timestamp, a cryptographic nonce, and a hash of the request body. This provides three protections:
If any part of the request is modified in transit, the signature will not match and the server will reject it.
The timestamp and nonce ensure that a captured request cannot be replayed later. Requests older than five minutes are rejected.
The signing key is derived from the user's authentication token, so each user has a unique key that rotates with their session.
Marcus supports multiple AI models from different providers. A natural question is: does using different providers compromise privacy?
The answer is no, because the same encryption architecture applies to every model. Regardless of which AI model you select, your messages are encrypted with the same AES-256-GCM process, wrapped with the same RSA public key, and forwarded through the same blind relay.
Furthermore, Marcus configures all AI provider integrations with explicit no-training directives. Your prompts are processed to generate a response and then discarded.
| Model | Provider | Encrypted | Stored | Training |
|---|---|---|---|---|
| GPT-5.2 | OpenAI | AES-256 | No | No |
| Claude Sonnet 4.6 | Anthropic | AES-256 | No | No |
| Sonar Reasoning Pro | Perplexity | AES-256 | No | No |
| Gemini 3.1 Pro | AES-256 | No | No | |
| Grok 4 | xAI | AES-256 | No | No |
| DeepSeek R1 | DeepSeek | AES-256 | No | No |
| Gemma 3 | On-Device | N/A | No | No |
Most AI chat applications offer privacy policies — promises written in legal language that can change at any time. Marcus offers privacy architecture — cryptographic guarantees enforced by mathematics, not policy.
Your data cannot be breached from our servers because it was never there. A breach of our infrastructure would yield authentication tokens and routing metadata, but zero conversation content. There is nothing to steal.
Forward secrecy means past conversations are safe even if a future key is compromised. Each session generates a fresh AES-256 key. There is no master key that unlocks all conversations.
On-device inference means zero trust required. If you use Offline Chat mode, you do not need to trust our server, the AI provider, your internet service provider, or anyone else. The computation happens on your hardware, in your hands, with no network activity whatsoever.
Marcus includes a built-in Privacy Transparency Report accessible from Settings. This screen displays real-time statistics about your encryption activity, including the number of encrypted sessions initiated, messages encrypted, and on-device inferences performed.
We also maintain a comprehensive automated test suite that continuously verifies every privacy claim made in this document. These tests confirm that no client-side code contacts AI providers directly, that the server cannot access plaintext message content, that the Gemma offline model makes zero network calls, and that all models route through the encrypted pipeline. The test suite runs on every code change before any update is released.
Marcus is not just an AI chat app with a privacy policy. It is a privacy-first architecture where encryption is not an add-on feature but the foundational design principle.
Your messages are encrypted before they leave your device. The server that relays them is cryptographically blind. AI responses are encrypted before they return. Your conversation history lives only on your device. And for those who want absolute certainty, on-device inference ensures your prompts never touch a network at all.
Your thoughts are yours. Marcus is built to keep it that way.