Confer's team writes about their end-to-end encrypted AI chat service and the privacy design behind private inference.
HN commenters point to Confer, made by Moxie Marlinspike, as the option for private AI chat, though one reports a passkey login problem and another is wary of its Google sign-in.
If we are talking about complete privacy. I am trying out https://confer.to (created by signal team) too and I am unable to run it on my mac (passkey support)(I tried it both in zen & orion) but I tried it on an android chrome (tablet) and I am kinda more optimistic about it too
I have heard good things about Kagi in fact, that's the reason why I tried orion and still have it in the first place but I haven't bought Kagi, I just used the free searches orion gives & I don't know if it has Kagi's assistant.
I think proton's Lumo is another good bet.
If you want something to not track you, I once asked cerebras team on their discord if they track the queries and responses from their website try now feature and they said that they don't. I don't really see a reason why they might lie about it given that its only meant for very basic purposes & they don't train models or anything.
You also get one of the fastest inferences for models including GLM 4.7 (which z.ai uses)
You might not get search results though but for search related queries duck.ai's pretty good and you can always mix and match.
But Cerebras recently got a 10 billion $ investment from OpenAI and I Have been critical of them from now on so do be wary now.
Kagi Assistant does seem to be good if someone already uses Kagi or has a subscription of it from what I feel like.
> you're still exposing your data to Confer
They use a https://en.wikipedia.org/wiki/Trusted_execution_environment and iiuc claim that your client can confirm (attest) that the code they run doesn't leak your data, see
https://confer.to/blog/2026/01/private-inference/
So you should be able to run https://github.com/conferlabs/confer-image yourself and get a hash of that and then confer.to will send you that same hash, but now it's been signed by Intel I guess? to tell you that yes not only did confer.to send you that hash, but that hash is indeed a hash of what's running inside the Trusted Execution Environment.
I feel like this needs diagrams.
Looks like Confer is hosting its own inference: https://confer.to/blog/2026/01/private-inference/
> LLMs are fundamentally stateless—input in, output out—which makes them ideal for this environment. For Confer, we run inference inside a confidential VM. Your prompts are encrypted from your device directly into the TEE using Noise Pipes, processed there, and responses are encrypted back. The host never sees plaintext.
I don’t know what model they’re using, but it looks like everything should be staying on their servers, not going back to, eg, OpenAI or Anthropic.
Somewhat related, i recently ran into the issue, after i created an account on Confer.to [1] on my Desktop, i couldn't login on my iPad / iOS with Proton Pass and/or Bitwarden.
The error message was: "Error: "Authenticator did not return a PRF result — this passkey probably isn’t PRF-capable."
So i now have an account, but can only use it on my Desktop.
(can't change to a password login either, it's Passkeys only...)
[1] end-to-end encrypted AI, developed by Moxie Marlinspike, the founder of Signal: https://confer.to/
There's a more-recent post on the same blog that gets into the details of how they're using the WebAuthn PRF extension to store key material, but for platforms and browsers that don't yet support the extension, you'll need a password manager that does. There's a table midway down the post with details: https://confer.to/blog/2025/12/passkey-encryption/
In the past, this was necessary to offer end-to-end encryption in web applications. Now, we can use the WebAuthn PRF extension[0] to enable encryption directly from a passkey, without having to deal with awkward key storage[1].
[0]: https://github.com/w3c/webauthn/wiki/Explainer:-PRF-extension
[1]: https://confer.to/blog/2025/12/passkey-encryption