PARANOID local runtime

— every push runs the full test suite, a real bubblewrap sandbox and a live Tor isolation check on GitHub-hosted Linux. Property-by-property evidence: https://www.paranoid.family/proof

A loopback daemon that sits between you and a remote AI model. It sanitizes prompts on your machine, shows you exactly what will be sent, routes each conversation through its own Tor circuit, can run bounded cover traffic, and refuses to send anything when a layer your privacy profile requires is missing.

The public site (https://www.paranoid.family) is marketing and documentation only. Prompts, keys and wallet state never go through it.

Requirements (Windows, as tested)

• Node.js 24+ (runs the TypeScript sources directly, no build step). Two pinned dependencies for the agent sandbox, shipped in the download: [email protected] and @jitl/[email protected] (MIT).
• Ollama with a local model for sanitization: winget install Ollama.Ollama, then ollama pull qwen3:8b (≈5 GB, runs on a 12 GB GPU; any instruction-following model served on loopback works).
• Tor: node scripts/install-tor.mjs --require-signature downloads the official Tor Expert Bundle into the profile directory and refuses to install unless the SHA-256 matches the published sums file and that file's OpenPGP signature is valid for the Tor Browser signing key EF6E286DDA85EA2A4BA7DE684E2C6E8793298290.
• To pay for inference, either an OpenRouter API key (entered in the UI, stored with Windows DPAPI; OpenRouter can link it to you), or the zkAPI wallet: a browser wallet such as MetaMask on Sepolia, test ETH (minimum deposit 0.001), and the operator's shared testnet password.

Install on Windows (one command)

In PowerShell, as your normal user:

irm https://www.paranoid.family/install.ps1 | iex

installer/install.ps1 installs Node.js 24, this runtime, Tor and Ollama with a local model into %LOCALAPPDATA%\Programs\PARANOID, checking every download (SHA-256 against the published sums; Ollama by its Authenticode signature), then adds Start Menu shortcuts, start at sign-in and an uninstall entry. Settings, keys and Tor data stay in %APPDATA%\paranoid.

Run

git clone https://github.com/paranoidfamily/paranoid && cd paranoid
npm install        # two pinned dependencies (QuickJS sandbox)
npm start          # = node src/main.ts
npm test           # 46 unit, integration and privacy-regression tests

Open http://127.0.0.1:7700/. Settings → paste the OpenRouter key, pick a remote model, pick the local sanitizer model.

The daemon starts and supervises tor.exe (SocksPort 127.0.0.1:9050 IsolateSOCKSAuth, ControlPort 0), then verifies through check.torproject.org/api/ip that traffic exits from a Tor relay.

Profile directory: %APPDATA%\paranoid (config.json, local-token, secrets\*.dpapi, tor\, tor-data\). Override with PARANOID_HOME.

Privacy profiles

Profile	Requires	Sends
Standard	model + key	directly; sanitization if available, or the original after explicit approval
Private	model + key, verified Tor, local sanitizer	sanitized text only, over the conversation's own Tor circuit
Paranoid	Private + zkAPI client + running cover traffic + agent sandbox	sanitized text over Tor, paid only with a zkAPI lease (your API key is never used); not available on /v1, which has no wallet

A profile never downgrades itself. If a required layer is missing, the UI shows which one and why, and the API answers 409 privacy_policy without contacting the provider.

Request pipeline

1. Rules (deterministic): secrets/API keys, private keys, wallet addresses, emails, IBANs, Luhn-valid card numbers, IPs, phone numbers, street addresses, introduced names → [EMAIL_1], [CARD_1]… Code blocks and inline code are set aside verbatim.
2. Entity extraction (local model): people and organizations tied to the writer (plus places and dates in strict) are listed by the model and masked deterministically ([PERSON_1], [ORG_1]…). A person's first or last name alone gets the same placeholder.
3. Rewrite (local model): impersonal task statements, unnecessary personal context generalized, placeholders and code kept.
4. Safety net: rules run again on the rewrite; a reintroduced identifier is masked again.
5. Review: the UI shows the exact text that will be sent (editable) and what stays on the device. Nothing is sent until you approve.
6. Send: through the conversation's Tor identity (Private), with an allow-listed request body and no identifying headers.
7. Rehydrate: placeholders in the answer are restored locally, including across streaming chunks.

Any failure in steps 1–4 (model server down, invalid JSON, wrong count, timeout) aborts: the original is never sent (502 sanitize_failed).

Sanitization reduces what the provider learns. It is not anonymization: the provider still reads the sanitized task, and writing style or the task itself can identify you.

OpenAI-compatible endpoint

GET /v1/models, POST /v1/chat/completions (SSE streaming) on http://127.0.0.1:7700/v1, bearer token from %APPDATA%\paranoid\local-token. Same pipeline without the review step (sanitization is automatic and fail-closed). Conversations are matched by transcript prefix (as in zkapi-clientd) or by the X-Paranoid-Conversation header; earlier user turns are replayed in their sanitized form and earlier replies are re-masked. Tool calling is refused.

This is the beginning of the README. Read the rest at the original. Read the full README ↗