Six principles that shape every line of code, every patent claim, every commercial contract Elo AI signs. They are not aspirations. They are operating constraints.
A privacy promise that lives in a privacy policy is a marketing artifact. A privacy promise that lives in the cipher key derivation function is a cryptographic property. We chose the second kind. Everything follows from that choice.
When Cognielo says "we cannot read your data," that is not a pledge. It is a statement about what is mathematically possible from the operator's vantage point. We made it impossible by design. HKDF(masterSeed, info: appNamespace) happens on your device. The master seed never leaves your device. Without the master seed, there is no key, and without the key, the bytes on disk are random noise. We can subpoena ourselves and find nothing.
This is not the most efficient way to build software. It is the only way to build software that survives a breach without becoming a story.
We do not separate "how we work" from "what we ship." Our engineering process — Polish, Harden, Executive Review per round, per module, per kit — is itself a patent-claim-generating artifact. Each cycle produces a SHA-256-hashed Polish Report and Executive Review, signed by the developer key, recorded in an append-only attestation log.
The runtime refuses to start if the attestation chain is broken. The methodology is not documentation; it is a runtime cryptographic invariant. Counsel will brief on whether this rises to a primary claim or a dependent. Either way: how we work is part of what we ship.
Cognielo and the Elo SDK default to Anthropic Claude because Claude is the AI we trust most for the kind of careful reasoning our users need. We are opinionated about quality. We are not married to a vendor.
Every Coach turn flows through our edge gateway. The provider can swap to OpenAI, Gemini, or on-device Apple Intelligence without an iOS release. The user's bytes never reach the provider in the clear. We pay the bill out of subscription revenue, not by selling user data. If our preferred provider raises prices, our gateway absorbs the shift. The user's experience is steady; the back-end is fluid.
An ad-supported tier is the moment a privacy product becomes a different product. We will not ship one. Not free, not premium, not "lite." The math closes without ads — the unit economics defend over-90% gross margin against Anthropic token pass-through across every SKU. We can pay our bills by selling the product. Therefore we will sell only the product.
This is not a phase. It is a contractual property of how Elo AI builds. The board, the cap table, and the patent claims are aligned around it.
If we say something works, we publish how. The patent claim ladder is public. The architecture diagrams are public. The eight worked-example anchors that map specific claims to specific source-code paths are public. Our SOC 2 posture, our threat models, our incident protocols — all part of the surface.
You should be able to verify the privacy promise from the cheap seats. We do not hide behind "trust us." We replace it with "here, look."
We do not use exclamation points in product copy. We do not write in growth-hack vernacular. We do not promise "10× your life." We make a small number of true statements, in calm voice, with the math behind them. We trust the reader.
This is also a product decision. Software that yells at its user becomes the user's enemy. Software that whispers becomes the user's tool.
All six lead back to the same seam: artificial intelligence is going to read everyone's data eventually, the only question is whose AI and on whose terms. We are building so the answer is "your AI, your terms."
"The user is not the product. The user is the customer. The customer holds the keys."
— Operating principle, Elo AI charter, 2026If you find yourself agreeing with these six principles, you will probably also like our products and our books. If you find yourself disagreeing, we are still happy you read this far.