Questions, answered plainly.

For adults who tell an AI what they’d tell no one, Dusken is the private AI confidant: private AI for conversations you want to remain yours, built so you can check.

Your AI remembers you. Our servers never do — no intentional plaintext persistence after inference, internally tested over enumerated surfaces.

Open models only — every model honestly carries the privacy promise, and no frontier lab holds a kill switch. A curated menu of four, not a 200-model sprawl: Quick, the fast everyday workhorse; Prose, a large open model tuned on long-form fiction and dialogue — the visible quality bar; and Deep, an open reasoning model, a fast-follow.

Long context by default, streaming, regenerate, branch or edit any turn. Sampler controls — temperature, top-p, system prompt, length — are free.

One-click import of V2 and V3 character cards, PNG-embedded and JSON — the portable format the entire Character.AI / Janitor / SillyTavern world already uses. Drag a card in; it works.

Bring over SillyTavern .jsonl logs and the Character.AI export formats Dusken currently recognizes, encrypted like everything else. Your characters arrive knowing where the story left off.

The published “never” column: a token · anything for minors · real-person imagery · frontier-model proxying · engagement-bait mechanics · selling or mining user data · gacha or loot-box monetization.

Everything Dusken remembers is encrypted on your device before it syncs; the server stores only the encrypted form. Internally tested over enumerated surfaces, not independently audited.

The Vault is one screen listing every memory as a human-readable card — read, edit, delete each one. Per-conversation toggle, global pause, one-click export, “forget this conversation” on every thread. Free forever, all tiers.

The AI that doesn’t remember you. One tap: no vault writes, no sync, no local history, nothing server-side — there never is. On every tier, every model, including free.

“Burner is on. When this chat ends, it never happened.”

Your chat history is stored in a lockbox only you can open. Your password (or a printed recovery sheet) is the key — we never have a copy, so we can’t open it, and neither can anyone who takes our servers. Lose both the password and the sheet, and it’s gone forever; that’s the deal that makes it private.

No reset button exists. That’s not a bug — a reset button would be a back door.

There is a complete receipts list — every scrap of data we hold, why we hold it, and the date it self-destructs. Chats aren’t on the list because we don’t keep them; what IS on the list (locked history boxes, account info, billing records, short-lived security counters) is published for anyone to read.

We can’t see your chats — but the moment you hit send, the message does travel to our computers to get answered. We don’t keep it. But “never touches our servers” would be a lie, so we don’t say it.

Free is $0 — generous daily chat, full memory, burner mode, and the importer. Core is $15/mo — unlimited chat, best models, priority speed, TEE-verified inference; annual is two months free. Pro is $25/mo — everything in Core, plus the security documentation pack, TEE-only routing, longer context, and priority support.

Memory, chat history, export, basic model choice, sampler controls.

The paid tiers buy speed, best models, verified-enclave routing, and volume.

A planned pay-as-you-go wallet for expensive extras — very long context, future media. Ships after launch. Card or crypto.

One-click cancel, fast refunds.

Planned: card or crypto — crypto is a checkout option, not an identity.

Tested by us, not audited by outsiders. We cancelled the expensive outside audit. So we never say “proven” or “audited” — we say “internally tested.” If we ever pay for a real audit, the language upgrades.

The trust page carries a live architecture diagram, a TEE attestation viewer anyone can run, the “verify us” packet-capture guide, and a transparency report with a warrant canary — including its limits: verification tools reduce trust in us, they can’t eliminate it.

The bar we hold ourselves to: a skeptical stranger goes from homepage to independently verifying a claim in under ten minutes.

The web client is open-source on GitHub from launch — the community can inspect the source and independently reproduce the builds. Inspection supports, but does not by itself confirm, runtime behavior — the served build is what the transparency log tracks.

Adults’ legal fiction and questions: yes. Real-person sexual imagery, minors in any context, serious-harm instructions: hard no — stated publicly, enforced technically.

If Dusken declines, it says so plainly and says why.

Accounts are email-optional — a username and passphrase works — alias-friendly, and no phone numbers, ever. Try-before-signup guest chat drops the front door to zero.

Adults only. Age assurance is planned to be privacy-preserving; the vendor and method are not chosen yet, so we make no promise about it today.

Transactional email only. No streaks, no notification spam, no engagement bait — a confidant doesn’t nag.

Self-hosted, aggregate-only. No third-party SDKs, no ad pixels, no session replay. The privacy page lists everything measured — the list fits on one screen.