Privacy by architecture
Your manuals never leave your phone. Not as a promise — as a design.
“We take your privacy seriously” is what companies say when the architecture doesn’t say it for them. So here’s the architecture.
The manual never goes anywhere
When you add a manual, Xgest reads it on your iPhone using PDFKit — Apple’s PDF framework, built into the OS. The text is extracted, indexed, and stored in the app’s private container on your device.
There is no upload. There is no copy on a server. There is no shared library of manuals, and there is no way for anyone else — including me — to see what’s on your shelf. Delete the app and it’s gone, because there was never anywhere else for it to be.
This isn’t restraint. It’s cheaper and faster this way, and it means there’s no honeypot to breach.
What actually goes out, and why it’s small
Xgest can’t write an answer on your phone. So when you ask something, three things go to our service at api.donbon.com:
- Your question, as you typed it.
- About five pages’ worth of paragraphs — the ones your phone decided are relevant.
- A photo, only if you chose to take one.
Concretely: a question about the Honda HR-V manual sends roughly 1,700 tokens. Sending the whole manual would be about 162,000. That’s 94× less, and it’s not a coincidence — the retrieval happens on your device precisely so the rest never has to move.
Nothing is retained. The request is answered and discarded. There’s no database of what anyone asked, because there’s no database.
Who touches it
Two companies, briefly:
- Anthropic — turns your question and those paragraphs into an answer. Their privacy policy
- Cloudflare — runs the service that passes it along. Their privacy policy
That’s the whole list. No analytics. No ads. No trackers. No accounts — you don’t have a login here because there’s nothing to log in to.
Why the citation is a privacy feature too
Every answer cites the page it came from, and tapping it opens the real PDF from your device. That page never travelled anywhere. The verification step is entirely local — which is the same reason it’s instant, and works with no signal.
The architecture in one line
If our server disappeared tomorrow, you could still open every manual you own and search it. Because it’s on your phone, not ours.
If “we take privacy seriously” makes you skeptical, you’re my kind of user.