Privacy by Design for a Desktop Operating System

Privacy is often described as a feature, but for desktop software it is better treated as an engineering constraint. Decisions about logs, permissions, network requests, updates, and defaults determine what a system reveals and what control users actually have.

Collect less by default

The simplest data to protect is data that was never collected. Desktop applications should have a clear reason for storing personal information, keep it only as long as necessary, and avoid collecting telemetry that is not needed for the product to work.

When diagnostic data is useful, users should be able to understand what is collected and why. A vague statement that data is used to improve the experience is not a substitute for clear documentation.

Make network behaviour understandable

A desktop can contact servers for updates, downloads, synchronisation, or optional online features. These behaviours should be documented and, where appropriate, controlled through settings. Offline use should not unexpectedly fail because an unrelated AI service or analytics endpoint is unreachable.

For AI features, the distinction between local inference and remote inference is especially important. Users should know when a request leaves their device and what context is included.

Secure defaults are part of usability

Security settings only help if users can understand them. Applications should avoid exposing secrets in logs, use appropriate file permissions, validate remote input, and provide clear confirmation for sensitive actions. Updates should be delivered through a process that users can verify and maintain.

Privacy also includes the ability to turn features off. An optional assistant should not become a hidden dependency for opening files, running commands, or using the desktop.

Be precise about guarantees

No operating system can honestly promise absolute privacy or security. Risks depend on hardware, applications, configuration, network behaviour, and how the system is maintained. A better approach is to explain the threat model, document the defaults, and make improvements measurable.

Aospix is exploring an offline-first approach to AI and a focused desktop experience. These are development goals, and the journal will share concrete implementation details as they become available.