There's a moment in every demo of our apps where we turn on airplane mode in front of someone and watch them wait for something to break. Nothing does. That moment is the whole product thesis: software that works with zero servers.
This post is about what that constraint does to how you build. The freedoms it buys and the problems it creates.
The constraint
Our apps, PromptSiege and the Offline AI Notebook, are built so that no feature requires a network connection. Not "works offline as a fallback." The network is simply not part of the design.
Taken seriously, this constraint eliminates entire categories of software:
- No backend. No API servers to run, patch, scale, or breach.
- No accounts. No password resets, no email verification, no credential database. Which is the highest-value target every breach headline is about.
- No telemetry. No analytics SDKs phoning home, because there is no "home."
- No CDN bills, no uptime pager, no database migrations.
The privacy story writes itself: you can't lose, sell, or leak data you never had. But the less obvious part is what this does to reliability and longevity.
What you get back
Reliability by construction. There is no service to go down. The app works on a plane, in a tunnel, in a rural area, during the provider outage that takes down everyone else's "offline mode."
Longevity by construction. A server-dependent app dies when the company dies or pivots. A self-contained app keeps working as long as the operating system runs it. That's not nostalgia. It's a property buyers of one-time-purchase software specifically care about, and we sell one-time unlocks, not subscriptions, precisely because the app doesn't cost us anything to keep running per-user.
Trust by construction. We can make promises most companies can't, because ours are enforced by architecture rather than policy: no data collection isn't a pledge, it's a description of the code.
The honest costs
None of this is free. The constraint creates real work:
- On-device models are a packaging problem. You need model downloads with explicit consent, disk-space handling, and graceful fallback when a device is too old. Each capability (chat, embeddings, speech) is its own model and its own integration.
- Sync is hard. So we don't do it. Your data moves between devices via export and import (CSV for receipts; for the notebook, the document library lives where you put it). For some users that's a dealbreaker, and we'd rather lose them honestly than pretend our sync is server-shaped.
- No server means no server-side fixes. Every bug ships to every user until they update. Discipline in releases matters more.
- Larger download, heavier runtime. Real models are gigabytes; sustained generation uses battery.
Why airplane mode is the test
Airplane mode is the cheapest possible privacy audit. If an app's features all work with the radios off, then by definition the app cannot be exfiltrating your data at that moment. There's no channel. Everything else. Policies, promises, certifications. Is secondhand evidence.
We think more software should be judged this way, and more should be built this way. The industry default assumes connectivity is free and data is the business model. For a growing set of problems. Note-taking, studying, security training, expense tracking. The phone in your pocket is already enough computer. The server was never required. It was just the default.