The problem
On a privacy product, the copy and the evidence are owned by different people and drift apart in one direction only. Marketing reaches for the strongest sentence the facts will bear, then keeps it after the facts move. Engineering knows the claim is thin and has no mechanism for saying so that survives a launch deadline.
Tellspike's whole proposition is that your question does not leave your phone, so a claim we could not defend was not a marketing problem. It was the product failing.
The decision
I wrote a table with one row per level of evidence. Each row names the artifact we actually hold, the exact sentence that artifact entitles us to publish, and whether we hold it yet. Copy that has no row is not copy.
The load-bearing move was splitting privacy claims into two kinds and never letting them share a sentence:
- Structured-identifier removal. Your name, number, and address never leave the device. This is verifiable, provable, and guarded in CI by a test that inspects the real request body. Say it plainly.
- Inference resistance. An AI cannot work out who you are from what is left. This is a matter of degree, measured rather than guaranteed, and the ceiling moves every time attackers get better. Only quantified, hedged versions of this, and only to the level the current evidence supports.
| Rung | Evidence held | What it entitles | Status |
|---|---|---|---|
| 0 | CI test asserting the real wire body carries only scrubbed tokens; free tier makes zero network calls | "Your name, number, email, and address never leave your device." | Earned, in CI |
| 1 | n=6 spike, one frontier attacker, coarse scoring | "In early testing, on-device rewriting roughly halved a top model's ability to guess personal details," with "early testing" said out loud | Held, directional only |
| 2 | n=100 paired eval, three attacker tiers, bootstrap confidence interval | A specific number for a specific category, with its interval attached | Earned |
| 3 | The eval runs as a regression gate plus a weekly job that fails on regression | "If the protection ever weakens, we catch it before you do." | Built |
| 4 | Frozen corpus, scoring hashes, reproduction bundle | "Do not take our word for it. The test is public and reproducible." | Tooling built, gated on a real-text corpus |
| 5 | Attested, verifiably stateless cloud inference | The only rung that closes the verifiability gap on the cloud path | Not available to us |
Higher rungs add to the ones below rather than replacing them. Rung 0 is always said plainly, because it is the only part that is a guarantee.
The retraction
The reason this artifact is worth showing is that it cost us a sentence. Here is the line, as it stood in staged copy:
an on-device AI rewrites your message before it leaves, blurring the details that let a model guess where you live or what you do
When the n=100 eval ran, location inference fell from 83% to 3%. Occupation fell from 88% to 60%.
Sixty percent is not protection. The ladder's own rule made the copy indefensible the moment the number existed, so "or what you do" came off and the published claim narrowed to location, which the evidence carried easily.
Occupation cues are woven into the questions themselves. Someone asking how to phrase a difficult note to a patient's family has disclosed their profession in the shape of the question, and a rewrite that removes it has answered a different question than the one they asked. The finding was not that the anonymizer was weak. It was that some identity signal is load-bearing for the message's own usefulness, which is why we also measure utility and not only leakage.
The distinction that resolved it: the re-identifying part is the specific employer, not the generic role. Employer is now stripped outright. The role stays, and the claim names the concrete set we can prove.
The ban list
The other half of the table is a list of phrases no evidence will ever entitle, because they are false by construction rather than unproven: "anonymous", "cannot identify you", "never learns who you are". No honest company can promise that an AI infers nothing, so the hedge is permanent and appears next to the strongest number we have.
What I would do differently
- Write the ladder before the copy, not after. This one was written against copy that already existed, which turned it into an audit. As an audit it worked, and it would have been cheaper as a constraint.
- Tie the strongest sentence to the tier it belongs to, visually. "Nothing leaves your phone" is true and CI-proven on the free tier. On the paid cloud tier, scrubbed text does leave. A reader who meets the strong line first will carry it across the page unless the layout stops them, and that is a design problem, not a copy problem.
- Publish the ladder with the product. It is more convincing than any claim inside it. A competitor can copy the sentence. Copying the table means running the eval.
The eval behind rung 2 ran against a stand-in anonymizer rather than the shipping on-device model, on a corpus written and attacked by language models rather than donated by people. Both gaps are known and neither is closed, which is why rung 4 is still marked as tooling rather than as earned.
← All case studies