{
"markdown": "# Lotti\n\n[](https://codecov.io/gh/matthiasn/lotti) [](https://flathub.org/en/apps/com.matthiasn.lotti) [](https://github.com/matthiasn/lotti/releases) [](LICENSE)\n\n[Discord for support](https://discord.gg/uuSaa8NpY)\n\n**A private logbook for the work you actually did.**\n\nLotti records what you meant to do and what actually happened, and keeps them\nas separate facts. Tasks, planned blocks, tracked time, voice notes, journal\nentries, habits, and health data live in a local database on your own devices,\nlooked after by a staff of personal AI assistants: persistent agents that read\nwhat you record, keep the mess summarised, and propose the next step — while\nproposed changes wait for your approval. No server ever holds your data in\nreadable form; sync is end-to-end encrypted, and the relay between your\ndevices holds only ciphertext — not forever. AI is optional, and when you do\nset it up, the route\nLotti recommends is European infrastructure running open-weight models.\n\nmacOS · Linux · Windows · iOS · Android. Flutter and Dart, GPL-3.0, in\ndevelopment since 2016.\n\nI have tracked around 11,000 hours of my own work in it since 2022.\n\n\n\n \n \n\n\n[Read the manual](https://matthiasn.github.io/lotti/manual/development/) ·\n[Install](#install) ·\n[Blog series](https://matthiasnehlsen.substack.com/p/meet-lotti)\n\n---\n\n## What is actually different about it\n\n**Intent and reality are separate records.** A task describes an outcome you\nwant. A time record describes what actually happened, with the notes, photos,\nrecordings, and measurements that explain it attached to it. Most tools flatten\nthe two into a single list and then ask you to pretend the day went to plan.\nLotti keeps them apart, so the record stays honest when the week gets noisy.\n\n**Agents propose, you decide.** An agent can read a task, form an opinion,\nsummarise a mess, and suggest a next change. Its report is an opinion with\nprovenance, not a new fact in your history. Task, checklist, status, and date\nchanges wait for you to confirm or dismiss them. The only exception is an\ninitial title or language for an otherwise empty task. This is enforced by the\nstorage layout rather than by careful prompting — see\n[Two databases](#two-databases-human-in-the-loop-by-construction).\n\n
\n \n \n \n \n
\n\n**No server ever holds your data in readable form.** Your logbook lives on\nyour devices. Sync is end-to-end encrypted: the relay you choose holds only\nciphertext, not forever, and nothing depends on it keeping anything — a new\ndevice catches up because your other devices re-send history, not because a\nserver archived it. No telemetry, and nothing uploaded to Lotti.\n\n**You choose the brain, and you can see what it cost.** Route each category of\nyour life to the compute you are willing to stand behind: a local model for the\nprivate things, a frontier model for work, or the European option Lotti\nrecommends. The usage view reports tokens and requests for every cloud call, and\nspend, energy and CO₂e for the providers that report them — today that means\nMelious. Local inference is not measured at all, because the cost moves onto\nyour own hardware and grid.\n\n\n \n \n\n\n---\n\n## Install\n\n| Platform | Where to get it |\n|--------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------|\n| **Linux** | [Flathub](https://flathub.org/en/apps/com.matthiasn.lotti) (recommended) or `tar.gz` on [Releases](https://github.com/matthiasn/lotti/releases) |\n| **macOS** | Signed and notarized DMG on [Releases](https://github.com/matthiasn/lotti/releases) |\n| **iOS / iPadOS / macOS** | TestFlight (limited; invitation only), with broader availability planned |\n| **Android** | APK on [Releases](https://github.com/matthiasn/lotti/releases), or Play Store internal testing (limited; invitation only) |\n| **Windows** | Build from [source](docs/DEVELOPMENT.md) for now |\n\n[](https://flathub.org/en/apps/com.matthiasn.lotti)\n\n---\n\n## What you can do with it\n\n### Capture\n\n- **Audio recording** anywhere in the app, transcribed locally with Whisper\n (99 languages) or Voxtral, or through a cloud provider with audio support. A\n rambling voice note comes back as a task with a checklist.\n- **Entries**: notes, images, measurements, and surveys, attached to the work\n they belong to.\n\n### Organize and reflect\n\n- **Tasks** with full lifecycle (open, groomed, in progress, blocked, on hold,\n done, rejected), checklists, estimates, priorities, due dates, labels, linked\n context, and optional generated cover art.\n- **Task agents**: give one task a persistent assistant with its own inference\n setup, report, wake state, and proposal history. Automatic updates decide\n when it wakes, not what it may change.\n- **Time tracking** recorded against the plan rather than instead of it, with\n focus ratings.\n- **Time analysis** over categories, habits, and measurements.\n\n\n \n \n\n\n- **Categories and labels** to make the boundaries that your decisions\n actually use.\n- **Habits, measurables, and health data** imported from Apple Health and\n other sources.\n- **Projects, events, dashboards, and embedding-backed search** exist and are\n in daily use, but ship switched off. Turn them on under Settings → Advanced →\n Flags, and expect rough edges.\n\n### AI and automation\n\n- **Providers, models, and inference profiles** as three separate layers, so\n routing is explicit and the blast radius of a change is visible before you\n make it.\n- **A European route, offered rather than imposed.** Onboarding highlights\n [Melious.ai](https://melious.ai), an OpenAI-compatible EU endpoint serving\n open-weight models. You bring your own key and hold your own contract with\n whoever you pick.\n- Works with everything else too: OpenAI, Anthropic, Mistral, Google, Alibaba,\n Nebius, OpenRouter, Ollama, or any OpenAI-compatible endpoint, including a\n custom base URL pointed at your own gateway.\n- **Agent templates and souls**: a template defines a responsibility, a soul\n defines voice, tone bounds, coaching style, and an anti-sycophancy policy.\n Both are versioned, both are improved through reviewable 1-on-1 sessions, and\n both can be rolled back.\n- **Grievances and 1-on-1s.** When an agent annoys you, say so — no form and no\n magic phrase required. It records the grievance and brings it up in the next\n 1-on-1, where the two of you reconcile what changes. The result is an\n assistant that evolves rather than one you configure once.\n- **Contextual skills** for work that does not need a durable agent, including\n prompt generators that turn a task plus your notes into a coding, design,\n image, or research brief you can paste into the tool of your choice.\n- **Usage and impact**: tokens and requests by period, category and model for\n every cloud call, plus cost, energy and CO₂e wherever the provider reports\n them — currently Melious. Other providers return token counts only, so those\n columns stay empty rather than being estimated.\n- Turn all of it off. Lotti is useful without any inference configured.\n\n### Sync and data\n\n- End-to-end encrypted sync across your devices, backed by a Synapse\n homeserver you or someone you trust operates.\n- The first device is provisioned server-side with the included\n [`tools/matrix_provisioner`](tools/matrix_provisioner) CLI, which creates the\n sync account and encrypted room and writes a single-use pairing bundle.\n- Every device after that pairs from one you already use: scan a QR code,\n compare a check code derived independently on both screens, then complete\n emoji verification. Until verification finishes, the new device receives\n ciphertext it cannot read.\n- Conflict resolution is built on vector clocks, so a device that was offline\n for a week rejoins without losing writes.\n- **Your data is a file you already have.** Local SQLite with a documented\n schema, plus attachments on the filesystem. No export wizard, because there\n is nothing to unlock.\n\n---\n\n## Two databases, human-in-the-loop by construction\n\nLotti keeps *what you said and did* and *what an agent thinks* in different\ndatabases on disk.\n\nThe **user database** is the system of record: tasks, notes, audio, time\nrecordings, journal entries. It is treated with care, and agents do not write\ninto it freely.\n\nThe **agentic database** is agent working memory: definitions, memories, wake\nhistory, reasoning traces, intermediate results. It may grow and it may be\npruned. It can be thrown away and rebuilt without losing anything that matters\nabout *you*.\n\n```mermaid\nflowchart LR\n subgraph Agentic[\"Agentic DB (prunable, recreatable)\"]\n A[Agent state & memories]\n W[Wake cycle reports]\n S[Suggestions]\n end\n subgraph User[\"User DB (system of record)\"]\n T[Tasks]\n J[Journal & audio]\n M[Metrics & habits]\n end\n A --> W --> S\n S -->|requires user approval| T\n S -.->|exception: initial title & language only| T\n```\n\nThe rule matters because of how it is enforced. Agent-authored content sits in\na different file on disk and reaches the user database only through a code path\nthat requires your approval. A misbehaving agent has no path to any other field\nin the user database.\n\nThe two narrow exceptions both concern fields that are still empty: an agent\nmay set the initial title of an untitled task, and the initial language of a\ntask that has none. Every subsequent edit needs your approval.\n\n---\n\n## Privacy, sovereignty, and where your compute happens\n\nThree different claims get flattened into the word \"private.\" Lotti makes all\nthree. They are worth separating, because they fail in different ways.\n\n### Your logbook is not collected\n\nLotti collects nothing. No telemetry, no analytics, and nothing uploaded to\nLotti. Entries live in local SQLite on each of your\ndevices, with\nattachments beside it on the filesystem. That is structural rather than a policy\ncommitment: there is nowhere for the data to go, and you can confirm it by\nreading the source or watching the traffic. Two things do leave, both because\nyou configured them: ciphertext to the homeserver you chose, and inference\nrequests to the provider you chose.\n\n*The other side of that:* there is no server-side backup and no account\nrecovery, because no server holds a readable or lasting copy of your data.\nSync is the redundancy story — but it is\nnot automatic history. Pairing a device gives it everything written *from then\non*; your existing settings and back catalogue arrive only when you run *Send\nsettings* and *Send message history* from the device that already has them.\nUntil you do, the new device is a live peer, not a backup. Do that early, and a\nsecond device means losing one costs you nothing.\n\nKeep an ordinary backup as well, since replication covers hardware loss and a\nbackup covers everything else. There is no export feature, because there is\nnothing to export from. Your logbook is a SQLite database sitting on your own\ndisk with a documented schema, so reading it takes a query rather than\npermission. Take a consistent copy with `VACUUM INTO` while the app is running,\nand bring the attachments directory along with it, because audio and images\nlive on the filesystem rather than in the database.\n\nOn a phone the database sits inside the app sandbox, so the practical route\nthere is to pair a desktop and take the copy from that peer.\n\nDeleting works the other way round, and the order matters: delete entries *in\nthe app* rather than deleting the database files. Purging removes an attachment\nby walking the deleted rows that still point at it, so a database removed first\nleaves its audio and images orphaned on disk. Paired devices and ordinary\nbackups keep their own copies either way, and anything already sent to a\nprovider is subject to that provider's retention, not yours.\n\n*What this does not protect against:* a compromised device. The on-device\nSQLite files live inside your OS user account and are not separately encrypted\nby Lotti today. App-level at-rest encryption is a candidate for the roadmap;\nuntil it lands, give Lotti's on-device data the same care you would give any\npersonal app on the same machine, and weigh that before putting your most\nsensitive categories in it.\n\n### Your sync infrastructure is yours\n\nSync runs over Matrix with Vodozemac for end-to-end encryption, against a\nSynapse homeserver you or someone you trust operates. The relay only ever\nhandles ciphertext. Encryption keys are shared only with devices you have\nverified through an emoji comparison, so a device that joins the account\nwithout completing verification receives data it cannot read. Both databases\nsync this way.\n\n*What this does not protect against:* metadata. Whoever runs the homeserver can\nobserve that a device synced, when, and roughly how much. Not what.\n\n### Your inference is a routing decision\n\nLotti has no inference backend. Every AI call goes to a provider you\nconfigured, under your own account and API key, and you choose per category\nwhich provider that is. Work can go to a frontier model while a journal stays\non a local one. That granularity is the entire point.\n\n**Onboarding highlights a European route.** [Melious.ai](https://melious.ai) is\na German company routing open-weight models across a network of EU\ninfrastructure providers, independently verified at\n[staysin.eu](https://staysin.eu/api.melious.ai). They state that requests are\nnot used for training and that data stays under European jurisdiction. Those\nare their claims, on their terms, and worth reading in full before you rely on\nthem.\n\nMistral, Google, Alibaba, OpenAI, Anthropic, OpenRouter, and any other\nOpenAI-compatible endpoint work equally well. Lotti does not rank them, does\nnot summarise their terms, and cannot verify anyone's claims about jurisdiction,\nretention, or training. Picking a provider is your decision and the due\ndiligence is yours.\n\nWhat Lotti does instead is refuse to let the decision be invisible:\n\n- Routing is configured per category, ahead of time, rather than negotiated in\n the moment — so which provider a given piece of work goes to is a setting you\n chose, not a prompt you clicked past. The flip side is that there is no\n just-in-time notice at the point an agent or a transcription fires; the\n onboarding and settings screens are where that decision is made and shown.\n- A friendly display name is not the security boundary. The provider detail\n view shows the actual base URL, the models attached to it, and every profile\n that depends on them.\n- Usage & Impact logs every request that left the machine and which model served\n it, with token counts throughout and cost, energy and CO₂e wherever the\n provider reports them.\n\nA LAN endpoint is worth the same scrutiny. \"Local\" means it did not go to a\nhosted provider, not that no network hop occurred.\n\n*What this does not protect against:* a provider that does not do what its\nterms say. Nothing in Lotti can verify that, and neither can anyone else from\nthe outside. What Lotti can do is show you every request it made, where it\nwent, and what it cost.\n\n### Running it all locally\n\nLocal inference is finally good enough to drive the agents. **Qwen 3.6 35B A3B**\nis the model validated in daily use here — 35B parameters with roughly 3B active\nper token, which is what makes it practical on a personal machine while still\nbeing smart enough for the agentic loop. Others probably work too.\n\nIt is power-hungry. Tested extensively on an M4 Max with 128 GB of RAM, the\nlaptop is audible under sustained agent load and the battery drains noticeably\nfaster than during normal work. Feasible, not free.\n\nHybrid is the realistic answer, and it is how I run it: a local model for the\nprivate categories, a cheap cloud model such as Gemini Flash for open-source\nwork and everyday task management. Speech is fully offline via Whisper or\nVoxtral either way. Image generation is the one thing with no local path yet —\ncover art goes through Gemini or Alibaba.\n\n### Energy is a routing decision too\n\nInference runs in a physical building on a specific grid. The **Usage & Impact**\nview reports tokens and requests for every cloud call, broken down by category\nand by model, so \"what did my thinking cost\" has an answer rather than a vibe.\n\nHow complete that answer is depends on the provider. Cost, energy, CO₂e and\nwater are recorded when the provider returns them with the response, which today\nmeans Melious; every other provider reports token counts only, and those columns\nstay empty rather than being filled with an estimate. That is a real limit on the\ndashboard: route your work through a provider that discloses nothing, and the\nimpact of that work is not something Lotti can show you.\n\nThe route highlighted in onboarding publishes power usage effectiveness per\ndatacenter and carries Green Web Foundation verification, which is more than\nmost disclose. Running a model locally moves the cost onto your own hardware\nand your own grid, which is a different trade rather than a free one, and the\ndashboard does not measure it.\n\nChoosing a renewable-powered route avoids outsourcing the health and climate\ncost of fossil-powered compute, gas turbine generation in particular, to\ncommunities with less power to refuse it. That is a reason to care where your\ntokens get processed even if you do not care who reads them.\n\n### If none of that satisfies you\n\nTurn AI off. Configure no provider at all, or point every category at Ollama\nwith local Whisper for speech. Lotti is a complete task manager, time tracker,\nand journal without a single inference call leaving the machine.\n\n---\n\n## In development\n\nBuilt and documented, but not enabled in a default build. Turn it on under\nSettings → Advanced → Flags, and expect it to change.\n\n- **Daily OS** (\"Enable DailyOS Page\") turns a spoken or typed check-in into a\n plan for one day. It reconciles what you said against your real tasks, drafts\n an agenda against your actual capacity, and presents every proposed change\n with its old time, its new time, and the planner's reason. Nothing is\n committed until you hold the confirm control. Wrap-up at the end of the day\n separates what you finished from what carries forward.\n [Documentation](https://matthiasn.github.io/lotti/manual/development/plan-and-capture/daily-os)\n\nNext agent types on the roadmap: week planners, long-term commitment monitors,\nand effort-against-goals balancers — same building blocks, different jobs.\nDesigned but not yet built: learning quizzes and relationship check-ins. See\nthe [roadmap](https://matthiasn.github.io/lotti/manual/development/roadmap).\n\n---\n\n## Pricing and sustainability\n\n**Linux is and will always be free, with maximum functionality.** No paywalls,\nno upsells. The same promise extends to any future fully open-source mobile\noperating system. The one thing it does not include is hosted sync\ninfrastructure — running a homeserver is a real cost, so you either self-host\nMatrix or bring your own.\n\n**On other platforms, the basics stay free too.** Task and journal capture, the\ntask agent, voice transcription, the everyday loop.\n\n**More advanced agent features may eventually be in-app purchases on platforms\nwhere IAP is the norm** (iOS/macOS, Android, Windows). The candidates: day- and\nweek-planner agents, overarching project-management agents, longer-horizon\ncommitment monitors. The exact split is not set yet.\n\n---\n\n## Documentation\n\n- **[Manual](https://matthiasn.github.io/lotti/manual/development/)** — the\n full guide, available in 11 languages. Start with\n [the mental model](https://matthiasn.github.io/lotti/manual/development/getting-started/mental-model)\n if you want to understand the shape of the thing before installing it.\n- [Connect an AI provider](https://matthiasn.github.io/lotti/manual/development/ai-and-automation/provider-setup/)\n — local Ollama or cloud Gemini, and the models and profiles around them\n- [Task management and voice capture](https://matthiasn.github.io/lotti/manual/development/getting-started/first-task/)\n — the everyday voice-to-checklist workflow\n- [Architecture](docs/ARCHITECTURE.md) — the two databases, vector clock sync,\n on-device inference\n- [Knowledge bundle](knowledge/index.md) — how the app actually works at\n runtime, subsystem by subsystem, written for contributors and coding agents\n alike\n- [Background](docs/BACKGROUND.md) — why this exists\n- [Privacy policy](PRIVACY.md) · [Security policy](SECURITY.md)\n- [Roadmap](https://matthiasn.github.io/lotti/manual/development/roadmap)\n\nBuilding it yourself: install Flutter via [FVM](https://fvm.app/) (the repo\nincludes `.fvmrc`), then `make deps`, `make analyze`, `make test`,\n`fvm flutter run -d `. Full setup, including the Linux audio-codec and\nemoji-font packages, is in [docs/DEVELOPMENT.md](docs/DEVELOPMENT.md).\n\n---\n\n## Status\n\nThe application is in active daily use and\nthe agentic layer is real, working, and shipping. Development happens in the\nopen, and the [changelog](CHANGELOG.md) is the honest version of what changed.\n\nWorth knowing if you are picking it up now: the design-system rollout is\npartway through, so some screens are polished and others are not. The agentic\nlayer is young — soul and template ergonomics, grievance handling, and pruning\nstrategies are all under active development, and feedback there is especially\nuseful. Local image generation and at-rest database encryption do not exist yet.\n\nThe manual, including every screenshot in all 11 languages, is generated from a\ndeterministic fixture workspace, so the documentation cannot quietly drift from\nthe build it documents.\n\n**Stack**: Flutter and Dart across five platforms, local SQLite via Drift with\nObjectBox for embeddings, Whisper and Voxtral for on-device speech recognition,\nMatrix and Vodozemac for the encrypted sync transport, Glados for property-based\ntests.\n\n---\n\n## Contributing\n\nTwo things genuinely help, and one thing to know up front.\n\n**Welcome:**\n\n- **Issues and bug reports** — the best place to start. Tell me what broke and\n how to reproduce it.\n- **Translations** — new languages and corrections to existing ones.\n AI-assisted translation is fine **provided you contribute from a real-name,\n established GitHub profile**. Translation PRs are the one kind that gets\n merged.\n\n**Not accepted: code pull requests.** Review capacity is the binding\nconstraint, Lotti holds people's personal data on their own devices, and\nAI-generated code now arrives far faster than it can be reviewed carefully. An\nunsolicited code PR will be closed unmerged, with thanks and without review —\nso please open an issue instead of writing the patch. It is more useful to me\nand cheaper for you.\n\nLotti is GPL-3.0: fork it and build whatever you like on top for yourself.\n\n[CONTRIBUTING.md](CONTRIBUTING.md) has the details, including what makes a\ntranslation PR mergeable.\n\n## License\n\nGPL-3.0. See [LICENSE](LICENSE).\n\n## Acknowledgments\n\nThanks to the [Flutter](https://flutter.dev) team, the\n[Qwen](https://github.com/QwenLM) and [Mistral](https://mistral.ai) teams for\ntheir open-weights models, [OpenAI](https://openai.com) for the\n[Whisper](https://github.com/openai/whisper) weights, the\n[Ollama](https://ollama.com) project, the [Matrix.org](https://matrix.org)\ncommunity, the [Vodozemac](https://github.com/matrix-org/vodozemac) authors, and\neveryone contributing translations, issues, and ideas.\n\n---\n\nBuilt in public. [GitHub](https://github.com/matthiasn/lotti) ·\n[Substack](https://matthiasnehlsen.substack.com)\n",
"bytes": 26803,
"sha": "c283c980dcb9719a2c1c0cf98ba19142fa2d00d5c50296246c45b5872cbb897b",
"repo_slug": "matthiasn/lotti",
"fonte": "repo",
"truncated": false,
"api": "https://agentalog.com/api/listings/okf_matthiasn_lotti_knowledge_index_md_0c1ebdd1/readme"
}
![\"The](\"https://pub-3df7bcf4b8ca493fa6acea182d69d9c7.r2.dev/manual/screenshots/development/tasks/workspace/desktop-dark.webp\")
\n![\"A](\"https://pub-3df7bcf4b8ca493fa6acea182d69d9c7.r2.dev/manual/screenshots/development/tasks/agent-suggestions/mobile-dark.webp\")
\n ![\"Usage](\"https://pub-3df7bcf4b8ca493fa6acea182d69d9c7.r2.dev/manual/screenshots/development/ai/usage/desktop-dark.webp\")
\n![\"Time](\"https://pub-3df7bcf4b8ca493fa6acea182d69d9c7.r2.dev/manual/screenshots/development/time-analysis/overview/desktop-dark.webp\")
\n