How Adap is built

“We take your privacy seriously” is worth nothing. Every company that ever sold your data said it. What actually matters is what the system can and can’t do, so here is how Adap is built, in enough detail that you can check the parts that are already live.

Privacy by construction, not by policy

The goal is simple to state and annoying to engineer: build it so that the harmful thing is not possible, not merely against the rules. A rule can be changed in an afternoon by someone under financial pressure. An architecture that never collected the data in the first place can’t be quietly monetized later.

That principle decides the boring stuff: where things are hosted, which third parties are allowed near your data (none, wherever possible), what gets stored and for how long.

This website, right now

Start with what you can verify today, because you can verify it right now, in this tab:

• Hosted in the EU. The server sits in Germany, subject to the GDPR, not to whatever a US data broker can get away with this quarter.
• No third-party requests. Open your browser’s network tab and reload. This page talks to exactly one origin: its own. No fonts from Google, no analytics from a tracking company, no ad pixels. There is nothing to check a box about because there is nothing loading.
• Cookieless analytics. Visits are measured with a self-hosted, cookieless tool (Umami) served from this same domain. It can’t follow you across sites and it stores no personal profile; the privacy page spells out exactly what it does record.
• Self-hosted email. If you join the early group, your address goes into a mailing system I run myself (Listmonk), not Mailchimp, not HubSpot, not a CRM that also sells enrichment data on the side.
• Defined as code. The entire server is described in a single, reproducible configuration (NixOS), and that configuration is going up on Codeberg so these claims can be checked rather than taken on trust. See below for what it is waiting on.

The app being built

I want to be precise about what exists, because vagueness here is how the category earns its reputation. The core conversation works. The five in-the-moment tools (breathing, grounding, reframing, brain dump, a light check-in) work. It already carries a little context between conversations. The mobile app is in progress.

Two things are deliberately not claimed as done. Encryption at rest for your conversations is a launch gate: the app doesn’t ship to the public without it, and I’d rather say that than imply it’s finished. And self-hosting isn’t here on day one; the architecture is being built so it stays possible, but shipping something that genuinely helps came first.

What is committed, structurally: your conversations are never used to train models, and your memory is yours: exportable in an open format, deletable at any time.

Why self-host everything

Every third-party SDK you embed is another company with a copy of your users, and another privacy policy you don’t control. The stack is deliberately boring and self-hosted for exactly that reason: fewer parties, fewer places anything can leak, fewer promises made on your behalf by someone you’ve never heard of.

It’s more work. That’s the point: the work is the thing being offered.

Coming: the source on Codeberg

Adap is built in the open, and “in the open” should eventually mean you can read the code, not just my description of it.

The source is going up on Codeberg, a non-profit, community-run home for open code. What it is waiting on is a security review. A server configuration is not just documentation: it names every service, every port, and every trust boundary in the system, so it gets read carefully before it is public rather than after. Publishing it carelessly would work against the exact thing it is meant to prove.

When it’s up, the link will live right here, and it’ll be announced to the early group first.

Until then, this blog is the record: every real decision and trade-off, written down as it happens.