Maple AI Review (2026): Is This Encrypted AI Private?

Type something into ChatGPT and OpenAI can read it and store it. In 2025 a federal judge ordered OpenAI to preserve ChatGPT logs that would otherwise have been deleted. Maple AI by OpenSecret (trymaple.ai) is built on the opposite premise: your messages are encrypted in the app and only decrypted inside sealed hardware designed to keep Maple's own staff out.

The skeptics have a point, though. On the Privacy Guides forum, a thread about Maple collected the fair objections: secure enclaves ask you to trust hardware rather than math, the models run on someone else's GPUs, and your account still leaks metadata. Those objections deserve straight answers, and Maple's open-source code supplies most of them.

Disclosure: Ten31, where I'm a managing partner, is an investor in OpenSecret, the company that built Maple, and Maple's founders have been on TFTC three times. Weigh this review with that in mind. It's based on Maple's published source code, documentation, release notes, and pricing as of September 2026, and the claims link to sources you can check.

Six things to know before you sign up:

• The privacy is architectural, with a hardware asterisk. Your app encrypts each request to an AWS Nitro Enclave it has verified, and the models run on confidential-computing GPUs. You're trusting hardware and published code instead of a privacy policy. That's a better deal, but it's still trust.
• Your keys don't live only on your device. Maple's enclave can derive them too, which makes this different from Signal. The protection comes from the enclave running published code that can't be swapped without the change showing up in the attestation your app checks.
• Open models only. You get nine chat models from the Kimi, GLM, DeepSeek, GPT-OSS, Gemma, and Llama families. OpenAI's GPT-5 line, Claude, and Gemini aren't on the menu.
• Free gets you 25 messages a week. Pro is $20 a month, Max is $100, and Team is $30 per user.
• Bitcoin works, with conditions. Checkout runs through Zaprite, on annual plans only, at 10% off. Team plans and the iOS app can't pay in bitcoin.
• A local model is still more private. Maple's own co-founder says so. Maple is the trade you make when your laptop can't run a model this size.

At a glance: Maple AI (2026)

Maple AI review: the verdict

If you want a capable AI assistant for the things you'd never type into ChatGPT, Maple is the one to try first. Attested secure hardware is the default for every conversation rather than an optional mode, your own app checks that attestation before sending anything, and the code is open source. It runs on every major platform, it takes bitcoin, and an anonymous account needs no email.

The costs are real. You get open models only, you trust AWS and GPU enclave providers instead of pure math, usage limits are loosely described, and payments are final. If your threat model says no third party may ever hold your plaintext, even inside sealed hardware, run a local model. Otherwise the free plan is enough to learn whether open models cover what you need.

What is Maple AI?

Maple is an AI assistant designed so the company running it can't read your conversations. It was built by OpenSecret, a startup making encryption-by-default infrastructure for apps, and launched publicly in January 2025. Co-founder and CEO Mark Suman is a former Apple software engineer who focused on AI and machine-learning privacy, and Anthony (Tony) Ronning is CTO.

In May 2026 the brand relaunched as "Maple," a "Personal Intelligence Platform" with three products:

• Maple Research is the chat app most people mean by Maple AI: long-form chat, document analysis, web search, and voice.
• Maple Agent is a personal assistant with long-term memory. It's in private beta behind a waitlist.
• Maple Proxy is an encrypted API in the same format as OpenAI's, so developer tools can run on Maple's private models.

The company names can confuse. Maple's site and legal terms say Maple Privacy Labs Inc., while the App Store listing names the seller Mutiny Wallet, Inc. and rates the app 4.7 out of 5 from 32 ratings. That seller name traces the team's path: it built Mutiny, a bitcoin Lightning wallet, then became OpenSecret, which built Maple and now operates as Maple Privacy Labs.

Maple AI has no connection to the restaurant phone-ordering AI also called Maple, or to Maplesoft's math software.

How does Maple AI work?

Maple protects your chats with two layers of sealed hardware and a check your app runs before it sends anything.

Layer one: the backend runs in AWS Nitro Enclaves. Login, key handling, encrypted storage, billing, and request routing happen inside AWS Nitro Enclaves. Amazon describes these as isolated virtual machines with "no persistent storage, interactive access, or external networking," whose contents even root users on the host machine can't reach.

Layer two: the models run on confidential-computing GPUs. Maple's code routes inference to two providers. Tinfoil runs "NVIDIA Hopper and Blackwell GPUs running in confidential computing mode." Continuum is the confidential AI platform from Edgeless Systems, the company behind Privatemode. Maple's backend enclave forwards each request to a GPU enclave over an attested connection.

Attestation ties the layers together. Before your app sends a word, it requests a signed attestation document from AWS's hardware, checks the certificate chain and freshness, and compares the enclave's code measurement (called PCR0) against a signed list of approved builds. Maple's transport protocol documentation says production clients fail closed, so the app refuses to connect if the check fails. Only then does it open an encrypted session that only that enclave can decrypt.

The code is public and reproducible. Maple's How It Works page says anyone can rebuild the open-source server code and compare the resulting hash against the live attestation. Each app release on GitHub also ships SHA-256 manifests for comparing store builds against the source.

Mark Suman explained the idea as a canary in a February 2025 TFTC interview. If Maple, or someone in its supply chain, ran different code, verification would fail and "the software just won't even talk to the back end anymore." His summary: "you don't have to trust us. You can verify it."

Is Maple AI private?

Yes, in the way that matters most for a cloud service. The design keeps Maple's staff, AWS operators, and anyone watching the network away from the content of your chats. Maple still sees some things about you, and a few kinds of data leave the enclave by design.

What Maple can and can't see

Maple's privacy notice says the company can see:

• account details, meaning your email or social-login profile and your payment information
• device and IP data, used for security, operations, and internal analytics
• API usage metadata such as request volume, timestamps, and errors

It's designed not to see chat contents, uploaded files, project names, or custom instructions. The transport documentation adds that proxies and load balancers in the path see only the endpoint, a session ID, ciphertext sizes, and timing. To keep your IP address from Maple as well, run the app behind a VPN like the one in our Mullvad review.

Three kinds of data leave Maple's enclave on purpose. Web searches go to the Brave Search API, which Maple queries anonymously on your behalf, so Brave gets the search text but not your identity. Model requests go to Tinfoil's or Continuum's GPU enclaves. And images sent to a model without built-in vision pass through what Maple's release notes call a "secure server-side image description path."

Is Maple AI end-to-end encrypted?

Between your device and a verified enclave, yes. Your messages are encrypted on your device, decrypted only inside an enclave your app has checked, and the replies come back encrypted the same way.

The difference from Signal is who holds the keys. In Signal, only your devices do. In Maple, each account's 12-word seed is generated inside the enclave and stored encrypted under an enclave secret, so the enclave can derive your keys too. Maple's How It Works page says so plainly: "Decryption keys live inside the TEE and on user devices."

The guarantee therefore rests on the enclave running only published code. AWS's key management service and its access policies are part of that trust, and Maple's own server README concedes that a source checkout "does not by itself prove the artifact, PCR, IAM/KMS policy, logging, or network configuration of a deployed environment."

The Privacy Guides objections, answered

Privacy Guides recommends no cloud AI at all, and its AI chat recommendations list only local tools. In a January 2026 forum thread about Maple, staff and members raised the objections below.

"Secure enclaves are trust, not math." Correct. A Privacy Guides staff member wrote that computing on plaintext inside an enclave "is simply not (and will never be) the same as mathematically protecting that data with strong encryption." A Privacy Guides team member called Maple's approach "about as good as you're going to get with cloud AI for now."

Both statements hold. Encryption protects your words in transit and in storage, but the model has to read them to answer, and hardware isolation is what guards them while it does.

"The GPUs belong to someone else." Also correct. Your app checks Maple's enclave, and Maple's enclave checks the GPU provider's. That puts AWS, Maple's published code, Tinfoil or Edgeless, and the NVIDIA, AMD, and Intel chips underneath all in your trust chain.

"What does attestation prove?" It proves a genuine Nitro Enclave is running a build whose measurement is on Maple's signed list, and that your session keys belong to that enclave. It doesn't prove the code is bug-free, that the hardware can't be attacked, or anything about metadata outside the enclave. What it changes is the object of your trust: from a company's policy to specific hardware running specific public code.

"Can I verify it myself?" The apps run the check automatically every time they connect. To go further, build the enclave image from Maple's tagged source with Nix, compare its PCR0 against the live attestation and Maple's signed history, and check your store app against the release hashes. Few people will, but anyone who finds a mismatch can publish it.

"Signing in exposes my identity." It can. Email and Google, GitHub, or Apple sign-in tie the account to you, so Maple also offers an anonymous account with no email that pairs with bitcoin payment. The catch raised in the thread: as of January 2026, multi-factor authentication only came through the social logins, and Maple's co-founder said passkeys were planned.

"There's no Monero." Maple's co-founder called Monero "on our list, but low at this time." Bitcoin through Zaprite is the private payment option. PPQ.ai, covered below, takes Monero.

"$20 a month is too much." For light users it may be. The free plan's 25 weekly messages cover occasional use, and in January 2026 Maple said it had no plans for pay-as-you-go pricing.

Why local AI is still more private

Maple's co-founder, posting as marks in that thread, ranked the options himself: "The most private AI is the local one that isn't connected to the internet. The next best is open-source TEE AI with hardware attestation that cryptographically verifies what code runs in the enclave."

A model running in Ollama or LM Studio on your own computer keeps everything on that computer (Ollama's separate cloud plan excepted). The limit is hardware, because model size is capped by your memory. Maple runs models far larger than a typical laptop can hold, and that's the trade.

Is Maple AI safe?

For a cloud AI service, Maple's security design is strong. The remaining risk sits in four places.

• Hardware attacks. Confidential computing can be broken. The TEE.fail researchers built a memory interposer for under $1,000 that extracts secrets from Intel TDX and AMD SEV-SNP and compromises NVIDIA GPU confidential computing, the same hardware families Tinfoil lists. The attack needs physical access to the server, and we found no Maple-specific incident.
• The web app. In our view the native apps, with published release hashes, are easier to check than a web page that loads fresh from Maple's servers each visit. Use a desktop or mobile app for your most sensitive chats.
• Company size. In a November 2025 TFTC interview, Mark Suman described Maple as "two people" building as fast as they can. That's quick shipping, but a thin bench.
• Compliance. We found no HIPAA or SOC 2 certification in Maple's materials, so check your own obligations before putting regulated client data in.

Which AI models does Maple AI use?

Maple runs open-weight models only. Its public model catalog listed nine chat models in mid-September 2026, plus a safety model available only through the API.

Most people never pick a model by name. The app's "Quick" option is the default on every plan, and "Powerful" points to GLM 5.3 as of September 2026. The lineup changes monthly, so treat the families as the stable part and the version numbers as a snapshot.

Running Kimi, GLM, and DeepSeek doesn't send your prompts to Moonshot, Z.ai, or DeepSeek. Maple runs the open weights on its own confidential GPUs, and its July 2026 business post says your data "never touches OpenAI, Anthropic, Google, or Chinese companies."

Are open models good enough?

Mark Suman's answer has grown more confident. In November 2025 he put open models at "like 90, 95%" of the best closed ones and compared the gap to driving an F1 car to work: "you don't need that extra horsepower." By a March 2026 TFTC interview he said flatly, "The open source models have caught up."

The same interviews carry two admissions. In March 2026 he said open-model tool calling still lagged, so an OpenClaw agent running on Maple would sometimes "go off and never come back." In November 2025 he said his own kids also share a family ChatGPT account because "there are things that chat can do that we can't on Maple." Maple claims GLM and Kimi now score near recent GPT and Claude models on standard benchmarks, and by its CEO's account the remaining gap is agent reliability and feature polish.

Maple AI features

• Web search. Free for all users and on by default since May 2026, using the Brave Search API.
• Documents. PDF, Word, TXT, and Markdown uploads on paid plans, in the apps only. Word text extraction and PDF text recognition run on your device.
• Images. Paid plans can attach images up to 20 MiB and use them with any paid model.
• Voice. Speech-to-text through Whisper Large v3 on paid plans, plus spoken replies, including an on-device voice option.
• Projects. Group chats with shared custom instructions and pinned chats, free for everyone and capped at 10 projects.
• Encrypted sync. Your history follows you across web, iOS, Android, macOS, Linux, and Windows, which arrived in June 2026.
• Agent Mode. The desktop app includes an agent built on Block's Goose, with support for MCP servers.
• No training. Maple says your data is never shared, sold, or used to train AI.

Maple Proxy is the feature for bitcoiners building agents. Pro, Max, and Team plans include an OpenAI-compatible API that handles attestation and encryption for you. It runs as a native binary, a Docker image, or inside the desktop app, and there's a StartOS package for Start9 home servers. Point OpenClaw, OpenCode, or Goose at it and your agent's model calls stay encrypted instead of going to Anthropic or OpenAI.

Suman told TFTC in March 2026 that he does much of his own Maple development in OpenCode running on Maple, while the team still uses Claude too. He's blunt about the agents themselves: giving one full access to your computer "really is like a virus." He goes further in Mark Suman on whether OpenClaw is safe.

Maple Agent is the bet on where this goes. A normal AI chat starts from a blank slate every time, while Agent is meant to remember you. Suman's case, from the same episode, is that people open up to AI they know is encrypted, "and that is where the most private AI can now become the most personal AI." Agent is still in private beta, so judge Maple on Research today.

How much does Maple AI cost?

The prices come from Maple's pricing page. A few details live elsewhere:

• The 25-message weekly cap on Free comes from the app's pricing code. The marketing page just says "basic AI features."
• Paid usage is credit-based, and the marketing site and app describe Max's usage multiple over Pro differently. Don't buy Max expecting a specific number.
• Extra credits for API use come in packs starting at $10.
• The old $5.99 Starter plan closed to new users in July 2025.
• Maple's terms make all payments for paid features final and non-refundable, so start with Free or a single month.

Is there a free version of Maple AI?

Yes. The free plan includes 25 messages a week, the GPT-OSS 120B and Llama 3.3 70B models, web search, Projects, and the same encryption paid users get. It leaves out the paid models, uploads, voice, and the API.

Can you pay for Maple AI with bitcoin?

Yes, through Zaprite, with three conditions set in Maple's pricing code. Bitcoin is for annual billing only, with a 10% discount that by our arithmetic puts Pro at $216 a year and Max at $1,080. Team plans can't be paid in bitcoin, and the iOS app has no bitcoin checkout.

Maple's pages say "Bitcoin" without specifying whether Zaprite's checkout offers Lightning, on-chain, or both.

Maple AI vs ChatGPT

ChatGPT has the stronger models and the bigger feature set. Maple has the stronger privacy, and the difference is structural.

OpenAI's data controls FAQ says consumer chats on Free, Plus, and Pro train its models unless you opt out, and Temporary Chats are deleted within 30 days. Those are policy controls over data OpenAI can read, and the 2025 preservation order showed a court can override them. TFTC's guide to is ChatGPT private walks through what OpenAI keeps and who can read it. Maple's design keeps the chat contents out of the company's reach in the first place, at the cost of open models only.

In November 2025 Suman argued that ChatGPT users end up "self censoring" because they know it isn't private. If you already hold back what you type into ChatGPT, that's the case for Maple.

Maple AI vs Venice, Lumo, and other private AI

Secure-hardware AI is no longer unique to Maple. The real differences are whether the protection is the default or an add-on, who checks the attestation, and whether your prompts get forwarded to closed-model companies.

Venice added an end-to-end encrypted mode in March 2026, but it's text only, with uploads, web search, and memory switched off. It offers far more models, with a free tier of 10 prompts a day and Pro at $18 a month.

Proton Lumo keeps zero-access encrypted history and says only its GPU servers can decrypt prompts, but its security model describes no remote attestation. You trust Proton's policy and EU jurisdiction instead of verifiable hardware on AWS.

Brave Leo needs no account and keeps no chats, with Premium at $14.99 a month. Its secure-hardware test covers a single DeepSeek model in Nightly builds, verified by Brave rather than by you.

Duck.ai gives anonymous access to closed frontier models whose providers still see your prompt text. Its help page promises zero data retention, while its privacy terms, updated in August 2026, still refer to deletion "within 30 days."

PPQ.ai is the most bitcoin-native: no subscription, no email, and payment by Lightning, on-chain bitcoin, Liquid, Monero, or card. Its private TEE models run on Tinfoil, the same provider Maple uses, though most of its catalog is proxied closed models.

Apple Private Cloud Compute is the reference design for this category, with bounties of up to $1 million, but it only powers Apple Intelligence features.

Local models remain the privacy ceiling, limited by your hardware. For more private tools that take bitcoin, browse the AI category or see Maple's listing.

Maple AI complaints and limitations

• No frontier closed models. GPT, Claude, and Gemini aren't available, and Maple's CEO concedes closed models still do some things better.
• Metadata stays visible. Maple can see your email or payment details, your IP address, and the size and timing of your requests.
• Vague usage limits. Free's cap isn't on the marketing page, and the site and app disagree on Max.
• No refunds. Every payment for paid features is final.
• Uploads need a paid plan and an app. The web version doesn't take files.
• Maple Agent isn't generally available. The memory assistant is still in private beta.
• Fast model churn. Models change monthly, and the App Store description still names an older lineup.
• Confusing privacy-notice wording. The notice says conversational data without memory features "is not retained after your session ends," while the app visibly keeps and syncs your chat history as encrypted data. Ask Maple which applies before relying on either reading.
• Account security gaps. As of January 2026 there were no passkeys, and MFA only came through social logins.

For privacy beyond the chat window, pair Maple with a VPN. Our Obscura VPN review covers a two-hop option.

Who should use Maple AI?

Frequently asked questions about Maple AI