On-device by design

Architecture

Two principles hold the whole product together: AI describes while deterministic engines compute, and everything runs on your device. Here's how that's built.

The Core Principle
AI describes. Math computes.
Most finance apps blur the line between what an AI says and what it calculates. Mindil Wealth doesn't. Language models classify your question, extract parameters, and write the commentary — but every figure you act on comes from deterministic, auditable engines. The two paths never touch: the engines and your data stay on your device, and the AI sees only what your sharing level allows.
On your device · local-only store, no cloud mirror
You ask "How did my tech holdings do this quarter?"
splits to both — in parallel
AI · Describes
Language, never arithmetic
›Classifies what you're asking
›Extracts range-clamped parameters
›Writes plain-language commentary
›Suggests follow-up questions
›Screened to describe, never advise
Apple Private Cloud Compute · Claude · GPT · Apple on-device · Local LLM — seeing only what your sharing level allows
≠
Never
mix
Engines · Compute
Every number you act on
›Time- & money-weighted returns
›Deterministic projections, no random sampling
›Capital gains across 10 jurisdictions
›Mortgage amortisation & net worth
Pure functions · reproducible · auditable
composed into one answer
You read Your tech holdings rose 6.2% this quarter.
What crosses the boundary — only what you opt into, encrypted

Your AI requests

Apple Private Cloud Compute by default, or your own Claude or GPT key, held in Keychain and sent device-direct to the provider — never through Mindil Wealth.

Encrypted copies

Backups, .wealthpackage shares, and Device Continuity · AES-256-GCM before they leave.

Market data & news

Provider-blind surface — your holdings stay home.

Because the maths is deterministic, the same scenario always returns the same result — and an AI can't introduce a wrong figure into the maths. Any figure the AI shows is checked against the computed facts before you see it, and Arya Stories follows the same rule: Arya chooses what to emphasise, the engines supply the numbers. It only describes what the engine computed.

Local-First Architecture
Three layers. One device. Your data stays home.
Mindil Wealth is built local-first. The app is organised into three layers — Features, Integrations, and Core — with dependencies that flow strictly one way: down to a Core that never reaches back up. Your data lives in a local-only store on the device, on-device AI handles what it can, and the only layer that ever touches the outside world is a tightly isolated Integrations layer.
01
02
03
flows down
FeaturesSwiftUI views & view models · coordinators
NetWorthArya · chat, insights, newsArya StoriesPerformanceTransactions · BankingProjectionsResearch · FXReal EstateTaxReports · SharingAnnotations
Integrationsprotocol-isolated — the only layer that touches the outside
SharesightSnapTradeAkahu · FinverseCSV importApple PCCClaude · GPTLocal LLM
Coremodels · services · AI · the dependency floor — no upward deps
ModelsServices · data planeAI · on-device surfacesFact pipelineAdvisory guardrailsValidation pipelineReference corpusKeychain
Local-only SwiftData store
Portfolio, banking, property, pension, chat, and annotation data are protected at rest by iOS Data Protection — hardware-backed and tied to your device passcode.
The only way out: HTTPS to providers you choose ·Apple App Attest ·Keychain-stored keys ·AES-sealed iCloud Drive sync ·no Mindil Wealth servers holding your data

There are no Mindil Wealth servers holding your portfolio. Outbound connections are limited to provider-isolated integrations — over HTTPS, App Attest–gated where they use the managed surface, and authenticated with keys stored in your Keychain. Device Continuity writes only to your own iCloud Drive, sealed under a key your devices hold.