Confer AI: A Private Chatbot Guide

We signed up for Confer, the encrypted AI chat from the creator of Signal, and tested it on the free plan. This guide walks through setup, every screen, the paid extras and the weak spots.

The short version: Confer (confer.to) is an AI chatbot that encrypts your conversations so that only your devices, and the sealed hardware that runs the AI, can read them. Your key comes from a passkey, the same Face ID or fingerprint sign-in your phone already uses, and the AI answers inside sealed hardware that outsiders can check. The free plan gives you 25 messages a day, 5 chats and 2 folders. Membership costs $34.99 a month and adds file uploads, connectors such as Gmail and better models. In our test the free plan handled questions, web search, memory and charts well. It can’t make images, has no voice chat, no Android app yet, and we found no published outside security audit.

Most AI chatbots keep a readable copy of everything you type. The company can look at it, use it to improve its models, or hand it over if a court asks. Confer says it is built so that it can’t do any of those things. Marlinspike announced it in December 2025 and comes from Moxie Marlinspike, who created the Signal messaging app. In his launch post he argues that a chat window invites confession, the kind of unfiltered thinking you’d put in a private journal, so it should be as private as a conversation with a person.

We created a free account on November 8, 2026 and spent eight of our 25 daily messages testing it. Anything we label as our test happened in that account. For the paid features we couldn’t open, we say so and use Confer’s own blog and screenshots instead. New to the idea of encryption? Our glossary explains end-to-end encryption in two minutes.

What is Confer?

Confer is a chat assistant that works much like ChatGPT or Claude: you type a question and it answers. It can search the web, remember facts about you between chats, draw charts and sort chats into folders. The difference is where your words can be read. With most assistants that is on the company’s servers. With Confer, it’s only on your devices and inside a locked-down computer that runs the AI model.

• Made by: Confer, founded by Moxie Marlinspike. The iPhone app is listed under Confer Enterprises, Inc.
• Where to use it: in a web browser at confer.to, or the Confer Private AI iPhone app (iOS 26 or later). There is no Android app yet.
• Models: open-weight AI models (models whose files are published for anyone to run), not GPT or Claude. Confer doesn’t say which one answers your chats.
• Price: free with limits, or $34.99 a month.

How does Confer keep your chats private?

Two pieces of technology make the privacy promise work. You don’t need to understand either to use Confer, but they explain what the privacy promise rests on.

1. Your passkey is your key. When you sign up, Confer asks you to create a passkey. Your device turns that passkey into an encryption key that never leaves your devices, according to Confer’s passkey post. Your chats are scrambled with it before they are saved. Confer stores only data it can’t read. Passkeys sync through iCloud Keychain or Google Password Manager, so your other devices can unlock the same chats.

2. The AI runs in sealed hardware. Your message has to be readable somewhere for the AI to answer it. Confer runs the model inside a Trusted Execution Environment (a sealed area of a processor that even the server’s owner can’t look into). Before your browser sends anything, it checks a signed report from the chip that proves which software is running, and that software is published and logged publicly, as the private inference post explains. The server code is open source on GitHub.

What it still knowsConfer can’t read your messages, but it does know your account email, when you use the app and how much. If you pay, Stripe or Apple handles your billing details. That is far less than most chatbots collect.

How much does Confer cost?

The plan screen inside the app showed two options on November 8, 2026:

Folder files, folder instructions and connectors also showed a members lock in our account.

Early coverage, including TechCrunch in January, reported 20 free messages a day; the app now shows 25. TechCrunch called the price “quite a bit more than ChatGPT’s Plus plan.” Our best AI assistants roundup lists what the big chatbots cost.

How do you set up Confer, step by step?

1. Go to confer.to in Chrome, Safari or Firefox, or install the iPhone app.
2. Choose Google, Apple or email. This only proves who you are. It doesn’t give Confer access to your Gmail or files.
3. Create a passkey when asked. Your computer or phone asks for Face ID, Touch ID, a fingerprint or your device PIN. This creates the key that locks your chats. On Windows and Linux you may need a password manager such as 1Password to hold it.
4. Name your assistant and say what it should call you. Both are optional; you can skip them.
5. Set up a recovery key in Settings, then Security & recovery. If you lose every device that holds your passkey and have no recovery key, Confer can’t get your chats back.

Don’t skip thisBecause only your passkey can unlock your chats, Confer can’t reset your access the way a normal app resets a password. Save the recovery key somewhere safe, such as a password manager.

A tour of Confer’s screens

Confer’s layout will feel familiar if you have used ChatGPT: chats on the left, the conversation in the middle, the message box at the bottom.

Settings has nine sections. The ones worth knowing:

• Personalization: your name, the assistant’s name, conversation starters and custom instructions. Confer labels it end-to-end encrypted and only visible to you.
• Memory: every fact Confer has saved about you, with edit and delete buttons.
• Appearance: light, dark or system theme, and the app language.
• Connections & tools: Google, Notion, Fastmail, scite (a research-paper search tool) and custom MCP servers (a standard way to plug other apps and tools into an AI).
• Import: bring your chat history over from ChatGPT or Claude.
• Data controls: export your chats as a file, or delete them all.
• Security & recovery and Account, where you can delete your account.

What happened when we tested Confer?

We used the free plan in Chrome on a Mac. Each row is one message, eight in all.

If you want to run the same privacy check on any chatbot you use, paste this in:

In plain English and under 150 words: who can read this conversation, what can your company see about me, and is it used to train your models?

Which Confer features need a paid membership?

Several of Confer’s biggest 2026 features are locked on the free plan. We hit the lock each time, so these descriptions come from Confer’s own blog posts.

• Connectors. Gmail, Google Calendar and Google Drive arrived in April. Confer’s connectors post says your own browser fetches the email or file and passes it to the sealed AI, so “none of that data ever touches our servers.” The settings screen now also lists Notion, Fastmail, scite and custom MCP servers. Confer’s built-in help text says Gmail can send email and Calendar can add events, showing you each draft to approve first unless you choose “Always allow.”
• Attachments and folder files. Members can attach PDFs, Word, PowerPoint, Excel, images and text files. The document search post (August) explains folder files: documents you add to a folder are encrypted on your device, and every chat in that folder can search them.
• Confidential workers. The newest feature, from September, gives the AI its own small, sealed computer for a single session. It can fill in a PDF, build a spreadsheet with charts or make a presentation, then hand you the file. The worker is destroyed when the session ends.
• Folder instructions (standing instructions every chat in a folder follows) and the Advanced AI models.

What has Confer added since launch?

Confer announces features on its blog, all written by Marlinspike. Nine posts so far:

Some changes have no blog post. In our account we found Notion, Fastmail and scite connectors, custom MCP servers, import from Claude as well as ChatGPT, and a referral offer. The iPhone app arrived in May 2026, and Confer’s built-in help text says it can connect to Apple Health on iPhone.

Confer and Meta

In March, Marlinspike announced that Confer would stay independent while he worked to bring its privacy technology into Meta AI, much as he helped bring Signal’s encryption to WhatsApp a decade ago. WIRED reported that WhatsApp’s head publicly backed the plan. In May, Meta launched Incognito Chat with Meta AI, which Meta says runs on its own Private Processing system. Neither company has said publicly how much of Confer is inside it. Our guide to Meta AI covers its other privacy settings.

What are Confer’s limits?

• No outside audit yet. We found no published third-party security audit. Cryptographer JP Aumasson told WIRED Confer is “probably the best private AI solution” but “lacks documentation of its architecture, threat model, and supply chain.” In plain terms, Confer hasn’t yet published full details of how it is built, which attacks it is designed to stop, and where its parts come from.
• You still trust the chip makers. The sealed hardware depends on processors from companies such as NVIDIA. Commenters on Hacker News, a tech discussion forum, debated whether that counts as full end-to-end encryption, since a flaw in the chip could expose data.
• No image generation and no voice conversations. On iPhone you can dictate, and Confer says the speech is turned into text on your phone.
• Smaller models. Confer uses open-weight models, not the newest ChatGPT, Claude or Gemini models. Marlinspike’s Meta post says some users missed those models’ abilities.
• Tight free plan. 25 messages a day and 5 active chats. Reloading the page during our test re-ran the welcome screens and created an extra chat, which appears to count toward the five.
• No Android or desktop app. Android and Windows users use the website.

Can you use Confer on your phone?

Yes on iPhone: the Confer Private AI app needs iOS 26 or later and uses the same account and passkey as the web version. On Android, use Confer in Chrome; Confer says a native app is in the works. We tested on the web only.

How does Confer compare with other private AI chats?

Confer, Maple and Venice’s Pro modes protect the moment the AI reads your message, not only the saved chat. Lumo and Duck.ai mostly rely on company policy at that moment (Duck.ai’s Tinfoil-hosted models are the exception). If you want the AI to run entirely on your own computer, see our Ollama vs LM Studio comparison. Our AI privacy guide covers all of these, plus settings for the big chatbots. Venice’s rise as a privacy-first chatbot was also a story in our daily newsletter.

Who should use Confer?

Confer is worth trying if you want to ask an AI about health, money, relationships or work problems without that conversation sitting readable on someone else’s server. The free plan is enough to see whether it suits you. Stick with a mainstream assistant if you need image generation, voice conversations or the most capable models, and remember that no chatbot is a substitute for a doctor, lawyer or accountant.

Frequently asked questions

Is Confer free?

Yes, with limits: 25 messages a day, 5 active chats and 2 folders on the Guest plan. Membership is $34.99 a month with a 2-day free trial.

Who makes Confer?

Confer was started by Moxie Marlinspike, who created Signal. He announced it in December 2025.

Can Confer read my chats?

Confer says no. Chats are encrypted with a key from your passkey, and the AI runs in sealed hardware. It can see account details and usage, such as when you use it. Its privacy policy says it doesn’t train on conversations.

What happens if I lose my passkey?

Use a recovery key, which you create in Settings under Security & recovery. Without the passkey or a recovery key, your chats can’t be recovered.

Does Confer use ChatGPT or Claude?

No. It uses open-weight models and doesn’t name the one answering you. You can import your old ChatGPT or Claude chats into it.

Can Confer make images?

No. In our test it said it can’t create images. Paid members can attach images for it to read.

You may also like

• Why Privacy Matters When Using AI
• Venice AI and Privacy
• What Is End-to-End Encryption?
• How to Delete Your ChatGPT Account
• How to Turn Off Meta AI
• Ollama vs LM Studio
• Element: Encrypted Chat on Matrix
• Best AI Assistants

Sources

• Confer blog: Confessions to a data lake (December 23, 2025)
• Confer blog: Making end-to-end encrypted AI chat feel like logging in (December 29, 2025)
• Confer blog: Private inference (January 5, 2026)
• Confer blog: Sorting secrets: how to organize encrypted data (January 21, 2026)
• Confer blog: Confer is bringing foundational AI privacy to Meta (March 17, 2026)
• Confer blog: Memory that forgets to tell anyone (March 29, 2026)
• Confer blog: Connectors without confiding (April 8, 2026)
• Confer blog: How to search documents we can’t read (August 1, 2026)
• Confer blog: Confidential workers for private AI (September 5, 2026)
• Confer Privacy Policy (October 2026)
• App Store: Confer Private AI
• Confer on GitHub (conferlabs)
• TechCrunch: Moxie Marlinspike has a privacy-conscious alternative to ChatGPT (January 18, 2026)
• WIRED: Signal’s Creator Is Helping Encrypt Meta AI (March 19, 2026)
• Meta: Incognito Chat with Meta AI (May 13, 2026)
• Hacker News discussion of Confer’s launch (January 2026)
• Proton Lumo
• DuckDuckGo: Duck.ai privacy
• Venice privacy
• Our test: a free Confer account in Chrome on a Mac, November 8, 2026. Screenshots by Beginners in AI; Confer blog images credited in captions.