AI that never leaves the device

Context

Managing personal finances with a modern tool currently means handing a third party the most sensitive data you have. The dominant model rests on bank aggregation: the user hands over credentials, their transactions are copied onto servers, and their spending behaviour becomes exploitable.

That model works. Commercially, it works very well. But it imposes a trade-off that is never made explicit to the user.

Diagnosis

Technical dimension

What required a server until recently no longer does. On-device models and Apple’s native text recognition now make it possible to run merchant recognition and statement import locally — the two workloads that historically justified sending data away.

Human dimension

Users’ reluctance to hand over banking credentials is not an irrationality to be talked around. It maps exactly onto the principles I argue for on engagements: minimisation of collection, data sovereignty, explainability of processing.

The privacy constraint was not a brake on the product. It was the product.

Levers

01 — Process locally by default

Benefit: eliminate the risk category rather than manage it. Data that never leaves cannot leak.

Local database, on-device AI models, native text recognition for statement import. No account to create, no banking credentials to supply, no analytics tracker.

02 — Make synchronisation an option, not a prerequisite

Benefit: offer multi-device convenience without reintroducing the risk you just removed.

End-to-end encrypted iCloud sync, which can be turned on or left off. The choice stays with the user, and the default is the more protective one.

03 — Keep external calls strictly consented

Benefit: maintain a legible boundary, and therefore a defensible one.

The only external services queried — a company register, mapping — are called solely on the user’s explicit request, for a merchant lookup. Outside that action, the app talks to no one.

Results

• Available on iPhone, iPad and Mac
• Transaction tracking, unlimited accounts, envelope budgeting, investment tracking, net worth, shared expenses
• Merchant recognition handled by models running on the device
• No financial data transmitted to a third-party server

What I took from it

Governance principles are not a cost, they are a position. The same trade-off — process locally rather than centralise — is presented as a regulatory constraint inside a company and becomes the primary selling point here. What changes is the framing, not the engineering.

Building what you recommend changes the nature of the advice. Having arbitrated between what an on-device model can do and what it cannot yet do gives a concrete read on what is realistic in an AI roadmap — and what is still announcement.

Data sovereignty is decided at design time. It cannot be retrofitted through a privacy policy written afterwards, in a company as much as in a consumer product.