- Version
- 1.0
- Effective
- Applies to
- Stuvio; Brello 1.0, version 1.0.0; Brello Super Intelligence, in development; this website
- Changes
- Published before they take effect, with a dated note and a redline (section 7.5)
01
Mission and scope
Our mission is to build capable intelligence that answers only to the person using it, with privacy that can be verified rather than promised.
That means Brello works for the person using it, not for advertisers or for us; what they share is used only to answer them; and where Brello runs, and what it keeps, can be checked by someone other than us.
This charter binds Stuvio, the company that makes Brello: “we” means Stuvio, and “Brello” means the software. It covers two products, written about in two tenses:
- Brello 1.0, a prototype Android app that runs its language model entirely on the phone, described as it ships.
- Brello Super Intelligence (Brello SI), which is in development, described as intent: what it is being designed to do.
02
Why privacy must be architectural
A privacy policy states what a provider has decided to do with your information; a system’s architecture decides what it is able to do. That is where we make our privacy commitments.
What people ask an assistant can be deeply personal: a symptom, a contract they can’t share, a photo of their home. A policy can change after you have shared something, but it can’t reach what was never sent.
So we follow one rule: work runs on your device whenever it can, and when it can’t, Brello’s servers must keep nothing, and someone other than us must be able to check that. Brello 1.0 meets the first half: its AI runs on the phone, and there is no Brello server. Brello SI is being designed to meet the second. Our privacy page sets out what stays on the phone, what leaves and when.
03
Three lessons from building Brello 1.0
Before asking anyone to trust a larger system, we built the strictest version we could: Brello 1.0, an assistant with no Brello server and no account. It taught us three things.
- A useful assistant can run entirely on a phone. After a one-time download of 977 MB to 3.66 GB, Brello 1.0 answers on the phone’s GPU, falling back to the CPU, and works offline. We believe many everyday questions can be answered this way, but we haven’t measured how many.
- Ordinary code around the model can make it more careful. While web search is off, Brello 1.0 asks “Search the web for this?” before looking up a question that seems time-sensitive. It cites web sources inline as [1] and [2], and stops a reply that starts repeating itself. Because small models copy the shape of their instructions, its base system prompt is four sentences long.
- A phone has hard limits. Brello Pro, the most capable of the three models, is recommended for phones with 12 GB of RAM. Each answer draws on only the last six messages of a chat, and a model small enough for a phone is far smaller than frontier cloud models and can be wrong.
Brello Super Intelligence is how we intend to go further, with the device still the default place where work runs.
04
What we intend to build, in three layers
Brello Super Intelligence is in development. This section describes design intent, not results. Layers marked ‘In Brello 1.0’ describe what the shipped app does.
Brello Super Intelligence is being designed for deep reasoning, long-term personal context and tasks done on a person’s behalf, in three layers, with information moving outward only when a task needs it.
Layer 1
Your device
Work is intended to run on your device whenever it can. Brello 1.0 processes every question, photo and answer this way.
In Brello 1.0Layer 2
Sealed compute
When a task needs more than a device can give, we intend to run it on hardware-isolated, stateless servers designed to keep nothing: no logs, no retention, no human access. Brello SI is being designed so that your device verifies a server before sending it anything.
In developmentLayer 3
The open web
Fresh facts are intended to come from the web only when you allow it, fetched directly from your device, read and cited. Brello 1.0 works this way: web search is off by default, Brello asks before going online, and the search engine and sites it reads see the search text and page requests as normal web requests, including the phone’s IP address.
In Brello 1.0Section 4 · Published architecture
We will publish a description of Brello Super Intelligence’s architecture, including what runs where and what each layer can and cannot see, before anyone outside the team uses it.
- Scope
- Check
- The description itself, published on this site with a version number and date, and linked from section 7.1.
05
Eight commitments
Each commitment says what we will or will not do, where it applies and how you can check it.
- 01
We will not use your conversations to train models.
We will not use your questions, photos, answers or chats to train or fine-tune any model, or for anything except answering you. Brello 1.0 never sends them to us: it processes and stores them only on the phone, and excludes them from Android cloud backups and device-to-device transfer. With web search on, the search text and requests for up to four result pages go directly from the phone to a search engine and those sites, which see normal web requests.
- Scope
- Check
- The Brello 1.0 system card lists everything that leaves the phone, when and to whom. None of it goes to Stuvio, and any other request is a security issue to report through our security page. For Brello SI, the architecture description (section 4) will state where conversations go and how long each layer keeps them.
- 02
We will not run advertising.
We will not show advertising in Brello or on this website, or use advertising to pay for Brello. An advertising business would reward learning more about the people who use Brello, which Brello is designed not to do. We haven’t announced pricing.
- Scope
- Check
- Brello 1.0 contains no advertising, analytics or crash-reporting software, as section 5 of our privacy policy states. This website sets no cookies and loads nothing from other sites, which your browser’s developer tools will show.
- 03
We will collect only what a task needs.
We will ask only for the information and permissions a task needs, and Brello SI will keep nothing it processes off your device once the task is done. Brello 1.0 has no account, and it reaches the camera and photos only through Android’s system picker, when you choose them.
- Scope
- Check
- The system card lists each Android permission Brello 1.0 requests, and why. For Brello SI, the architecture description will state what each layer receives and how long it keeps it.
- 04
We will evaluate each new capability before release, and publish what we find.
Before Brello can do something new, we will test how it could fail or be misused, and hold the release until it meets criteria set before testing began. The release will come with an evaluation summary: what we tested and how, the criteria and when they were set, what we found, and what the release still gets wrong. If we withhold a detail, such as a test that would work as instructions for an attack, the summary will say so and why.
- Scope
- Check
- The evaluation summary, published with the release. ‘Evaluate first, then ship’ and our safety page set out the approach.
- 05
We will ask before Brello spends money, sends a message or deletes something on your behalf.
Brello SI is being designed to draft, suggest and prepare work for you. It will not spend money, send a message or delete anything on your behalf until it has shown you the action in plain terms and you have confirmed it.
- Scope
- Check
- The architecture description will set out the confirmation step, and the evaluations under commitment 04 will test it. An action taken without your confirmation is a security issue to report through our security page.
- 06
We will build Brello to say when it isn’t sure, and to cite its sources.
Brello will be instructed to say when it isn’t sure and to cite the sources it relies on. Brello 1.0’s system prompt says: “If you are not sure about something, say so instead of guessing.” With web results, the model is told to cite them inline, like [1] or [2], and each citation links to its page. An instruction is not a guarantee: a small model can still be wrong.
- Scope
- Check
- The system card quotes both instructions. Brello SI’s evaluation summaries will report how often it says it isn’t sure when it should.
- 07
We will let you see, correct, export and erase what Brello remembers about you.
Brello SI is being designed to carry long-term personal context. It will not remember anything about you beyond a single chat unless you can see, correct, export and erase what it holds.
- Scope
- Check
- The four controls will ship with long-term memory, not after it, and the architecture description will say where that memory is stored.
- 08
We will make Brello SI’s privacy verifiable by independent researchers.
We are designing Brello SI so that independent researchers can verify what runs, where it runs and what it keeps, and we will publish what they need before anyone outside the team uses sealed compute.
- Scope
- Check
- ‘Private compute you can verify’ describes the design we are working towards, in which devices accept only software published in a public transparency log. Researchers can report what they find through our security page.
06
Five things we will not do
These lines bind Stuvio, and like the rest of this charter they change only through the process in section 7.5.
We will not sell, rent or trade your information.
- Scope
- Check
- Section 6 of our privacy policy says the same, and Brello 1.0 sends us none of your questions, photos, answers or chats.
We will not build advertising profiles, or let anyone else build them through us.
- Scope
- Check
- As for commitment 02: neither Brello 1.0 nor this website contains analytics or advertising software.
We will not widen what we collect without telling you first, in plain words.
- Scope
- Check
- A note on our news page, published before the change takes effect.
We will not release a new capability that we haven’t evaluated.
- Scope
- Check
- The evaluation summary required by commitment 04.
We will not imply an endorsement we don’t have, or a capability we haven’t shipped.
- Scope
- Check
- Our editorial standards set out how we credit the open models Brello is built on, how we describe work in development and how to report a statement that breaks this line.
07
Accountability mechanisms
Five mechanisms let people outside Stuvio check whether we keep this charter. Each status is as of 5 October 2026.
- 7.1
Published architecture
We will keep a current, dated technical description of how Brello handles your questions, photos, answers and chats: what runs where, and what each part can see.
- Status
- Published for Brello 1.0 as the system card and our privacy page. For Brello SI, due before anyone outside the team uses it (section 4).
- 7.2
Published evaluations
We will publish the evaluation summaries that commitment 04 requires, with every release of Brello SI and every new capability in any Brello release.
- Status
- None yet, because no such release exists.
- 7.3
Transparency reports
We will publish a report on the legal requests for user information that we receive, by category, and how we responded: the first before anyone outside the team uses Brello SI, then at least once a year.
- Status
- No report yet. Brello 1.0 sends us none of your questions, photos, answers or chats, so we hold none to hand over.
- 7.4
Access for independent researchers
We will keep an open route for security and privacy researchers to report what they find, with a safe harbour for research done in good faith.
- Status
- In effect, through our security and responsible disclosure page and the
security.txtfile at/.well-known/security.txt.
- 7.5
Plain-language notes on changes
If this charter changes, we will publish the new version before it takes effect, with a dated note on what changed and why, and a redline against the previous version. Earlier versions will stay available at their own addresses, and no change will apply weaker terms to anything you have already shared.
- Status
- No changes since version 1.0. Section 10 will record each one.
08
Status as of October 2026
Brello 1.0 is an app for Android and iPhone, version 1.0.0 (build 1, 4 October 2026), on Google Play and the App Store. Its three models are built on open models from Google and Alibaba, released under Apache 2.0, and Brello is not affiliated with or endorsed by either company.
Brello Super Intelligence is in development and has no published results. All eight commitments will apply to it before anyone outside the team uses it. Table 1 shows which already apply to Brello 1.0.
| Commitment | Brello 1.0 |
|---|---|
| 01No training on conversations | In effect |
| 02No advertising | In effect |
| 03Only what a task needs | In effect |
| 04Evaluation before release | PartlyApplies to new capabilities. Version 1.0.0 predates the charter and has no published evaluation; the system card lists its automated tests. |
| 05Confirmation before acting | Not applicableBrello 1.0 can’t spend money or send messages. |
| 06Uncertainty and citations | In effectBy instruction, without a guarantee. |
| 07Control of memory | PartlyNo memory across chats. Chats can be read and deleted, one at a time or all at once, but not exported. |
| 08Independent verification | Not applicableThere is no Brello server to verify. |
09
Open questions
We don’t yet know how far on-device intelligence can go, or how to make verifiable privacy simple enough for people who aren’t experts. Three questions shape the work this charter governs.
- How much can run on a phone. We don’t know how much of Brello SI’s work will fit on a phone and how much will need sealed compute. The answer decides how often information leaves the device at all.
- Verification for people who aren’t experts. Researchers can audit a transparency log, but most people will rely on someone else’s check, and we don’t yet know how to make that reliance simple and well founded.
- Evaluating personal context without personal data. Commitment 01 rules out testing long-term memory on real people’s conversations, and commitment 04 requires testing it before release. We intend to use synthetic profiles, and we expect them to miss much of real life.
We will publish what we learn through Brello Research.
10
Version history
Each version is listed with its date and what changed. From version 1.1, earlier versions will be linked here with redlines.
- 1.0First published, and announced in our news post ‘We’ve published the Brello Charter’.
The Brello team at Stuvio
Version 1.0 · 5 October 2026