Mark Suman & Tony Ronning: AI That Won't Share Your Data

↓ Jump to the video and timestamps

A few weeks before this conversation, I bought an annual subscription to Maple AI, the encrypted chat app built by OpenSecret, tweeted about it, and told people to try it. The replies came fast. Somebody prompted it and asked who it sends data to, and the Llama model underneath answered with Meta's boilerplate about Facebook.

So I used Maple to research how Maple works, and then I brought Anthony (Tony) Ronning and Mark Suman back into the studio to explain it in plain English.

Anthony and Mark came out of Mutiny Wallet. What they built next is OpenSecret, a backend that lets any app developer keep user data locked inside secure enclaves in the cloud, and Maple is the first app running on it. Disclosure up front: Ten31, where I'm Managing Partner, backed Mutiny's preseed round and lists OpenSecret in its portfolio.

The frame I can't shake is Mark's. The web already went through one big encryption shift when HTTP became HTTPS. The cloud is due for the next one, and AI is the reason it can't wait.

Key takeaways

• HTTPS protected the wire and left the database wide open. Once your data lands on a server, it usually sits in a plain-text database that employees, data buyers, and hackers can reach. AI apps are now pouring far more intimate data into the same kind of databases.
• Secure enclaves put the lock in the hardware. Code runs in an isolated, attested environment that the server operator can't inspect, and anyone can check that the running code matches what's published on GitHub.
• You no longer need to be a programmer to audit open-source code. Mark's suggestion is to hand the latest release to a reasoning model and ask whether anyone slipped in a backdoor.
• Your AI chats are building a profile of you. Anthony described a friend's simple recipe question coming back with "as a Christian" and "as a Rust developer" woven into the answer.
• Pasting business data into closed AI helps your competitors. Mark's argument is that whatever a model learns from your analysis makes it smarter for the next company that asks a similar question.
• The government's own advice flipped. After Salt Typhoon, US officials told Americans to use encrypted apps, years after the Justice Department pushed tech companies to keep a way in for law enforcement.

How the founders use AI to build the company

We recorded the week xAI launched Grok 3, and the part of the livestream I cared about was the hardware. The Colossus supercomputer in Memphis went up in 122 days inside a converted Electrolux factory, running on generators while the grid connection caught up.

That's the off-grid Bitcoin mining playbook applied to an AI data center.

My read, after six years around mining: GPU loads ramp up and down hard during training, and xAI was smoothing them out with Tesla batteries. A miner could sit in that gap and earn revenue instead of just buffering, which is why the mullet miner idea makes sense to me. Core Scientific had already signed on to host CoreWeave's AI compute, though a lot of the "miners pivoting to AI" talk was still more narrative than reality.

Anthony is the developer I point people to when they ask what AI-assisted coding looks like day to day. A year or two earlier he was anti-AI and sure it would spit out bad code. By the time we sat down, he was the only developer at OpenSecret and figured AI was writing about 90% of the code.

His toolchain at the time was a relay. Cursor with Claude for implementation, Perplexity for search, o1 pro for thorough analysis, OpenAI's newly launched Deep Research for scoping features, and CodeRabbit reviewing every pull request. The output of one tool becomes the input to the next.

The part worth stealing is how he prompts reasoning models. He writes one long prompt instead of chatting: a sentence or two on the goal, what he wants returned, the few constraints that matter most, and then only the files relevant to the feature, with his loose thoughts at the very bottom.

It lines up closely with Ben Hylak's argument that o1 is a report generator, not a chat partner, and the goal, return format, warnings, and context dump structure that was making the rounds that month. Anthony will even have Cursor write the prompt he hands to the reasoning model, and he expected Anthropic's Model Context Protocol to push all of this toward specialized agents that each do one job.

Mark's hack is simpler. When a chat goes well, ask the AI for the prompt that would get you back to that spot next time. He starts most days by tapping the microphone button on his iPhone and rambling to Maple about everything on his plate, then lets it prioritize the day.

His reason for doing that in Maple:

The thing that I love about doing it in Maple and not doing it in ChatGPT is I can get very personal.

On jobs, the jury is still out and the data hasn't been collected. Anthony's analogy was that construction workers didn't disappear when the hammer showed up. My hope is that people get to spend more time on interesting problems and less on the low-level yeoman work, and Mark's point was that a two-person company holding off on hiring frees up talent to go start the next company.

From Mutiny Wallet to OpenSecret

Mutiny was a self-custodial Lightning wallet with ecash support that ran right in the web browser, no app download required. The team later spun out Harbor, a desktop ecash wallet, too.

At its peak Anthony said they had thousands of users, some days a thousand a day. They also launched in 2023, the year Ordinals inscriptions drove Bitcoin fees to multi-year highs, and he described the experience as hell from day one. Liquidity, locked funds, forced channel closures, fee spikes.

Lightning had been around for years and still had too many ways for a normal person to lose money. Reaching 99.99% reliability for a self-custodial wallet started to look unmaintainable, and in August 2024 Mutiny announced it would shut down the wallet at the end of the year.

What survived was the plumbing they had built around the wallet. Encrypted sync so you could log in on a second device without losing state. Sign-in with Apple, Google, email, or a passkey while the keys stayed protected. That became OpenSecret, which the team introduced in November 2024 as a backend that turns private encryption on by default.

Mark added the piece I think most Bitcoin developers still resist. There's a meme in our world that you can't win by selling privacy. The next hundred million users pick whatever is easiest, so OpenSecret handles key generation for you inside a secure enclave, and the key still belongs to you.

HTTPS fixed the wire, not the database

Mark walked through the history. In the 90s we loaded our AOL CDs and browsed pages that traveled in plain text, which was fine because nobody was sending passwords. Banking, eBay, and PayPal brought the little lock icon, and by 2018 83 of the top 100 sites used HTTPS by default.

Then Edward Snowden showed what that lock didn't cover. The PRISM documents described direct access to the systems of the biggest US tech companies. Your data was safe on the wire and sitting in a honeypot once it arrived.

Mark lived the other side of this early in his career at an online backup company. Customers could encrypt their files with their own private key, but only about 10% did, so when someone called support to restore their family photos, the company could see everything.

Every app on your phone works this way today. Mark's example was a running app that stores your location. You don't know the 30 or 50 people who work there, and a breach tells a stranger exactly where your house is on your daily loop.

It's a liability for developers, too. Mark put the cost of a breach at around $9 million, and IBM's 2023 report put the average US breach at $9.48 million.

How OpenSecret encrypts user data with secure enclaves

If you've made it this far and still don't know what an enclave is, Mark's explanation is the one to remember:

It's like this transparent box where you shove a bunch of code in there and then you lock it and you can look inside the box and see the code that's in there.

You can see the recipe. You can't see the ingredients passing through. Mark said that's where the name comes from: you can view the open code that's running, but you can't see the data.

Anthony started from something everyone already carries. The Face ID prompt on your iPhone is backed by Apple's Secure Enclave, a hardware subsystem built so even Apple can't easily get in. Cloud providers now offer the same idea for servers. OpenSecret runs on AWS Nitro Enclaves, isolated virtual machines that produce a signed attestation proving which code is running.

Anthony credited Carl Dong's point from our episode on Obscura that Apple is doing a lot of this right. The catch is that Apple opens its Private Cloud Compute to security researchers under its own terms, and you as the user can't see the code.

OpenSecret publishes its enclave code and makes the build verifiable, and the check happens in the app itself. If the attestation doesn't match the expected code, the requests stop.

Mark compared it to a warrant canary. If they, or anyone in their supply chain, pushed different code to the servers, the verified badge would disappear and the app would refuse to talk to the backend.

Then he added the part that got me. Verifying open-source software has always meant trusting that some watchdog developer read the code. I think I've PGP verified Bitcoin software once in my life because it's too hard. Mark's suggestion is to download the latest release and ask a reasoning model whether anybody inserted a backdoor, which puts a lot more eyes on the code.

The GPU is the last hop. NVIDIA made confidential computing on H100s generally available in April 2024, less than a year before we recorded. At the time, Maple ran Llama 3.3 70B inside a GPU enclave, and the request stayed encrypted all the way to the GPU. The company hosting the hardware could be anywhere in the world and still couldn't read your prompts.

Your AI is building a file on you

Anthony had no patience for the way the big labs describe their data collection. Anthropic framed its Clio research on how people use Claude as privacy-preserving analysis. His response was that you're still describing what every user is typing, and the prompts still come in as plain text.

He also warned about "private AI" services that are really proxies. They put a nicer privacy page in front of ChatGPT or Claude and forward your data anyway. His friend's story is the one that stuck with me. The friend asked Perplexity for a recipe using what was in his kitchen, then asked whether he could swap an ingredient. Near the bottom, the answer started working in lines like "as a Christian" and "as a Rust developer."

A cooking question, answered with a profile of who you are.

Mark's test is to ask ChatGPT to build a dossier on you as if the CIA were coming after you, then read what comes back. Anthony pointed to research he learned about in college: the dates and locations of just four credit card purchases were enough to identify 90% of people in a dataset of 1.1 million users.

This is where I get worried about business data. At Ten31 we do industry analysis and balance sheet work, and I can imagine a company dropping a startup's financials or pitch deck into an AI to speed up diligence. If that data ends up training the model, that's a lapse of fiduciary responsibility.

Mark took it further. Even if the AI company never acts on your information, the model gets smarter about your industry from what you shared, and a competitor asking a similar question six months later gets the benefit. He also pointed out that employees paste company information into these tools because they want to do good work, and the business owner is the one exposed if it leaks.

Salt Typhoon and the encryption flip-flop

When China got into the US telecom networks, US officials urged Americans to use encrypted messaging apps. Mark joked about it on tape, and Anthony pointed out how absurd the timing was.

For years the government's line was that end-to-end encryption protects criminals. In 2019 the Attorney General signed a letter asking Facebook not to roll out end-to-end encryption without a way for law enforcement to read messages. Then a foreign adversary sat in the telecom databases and suddenly encryption was for everybody.

We've had a data breach segment on Rabbit Hole Recap for seven years. If the HTTPS parallel holds, encrypting user data at rest should become the standard the same way the lock icon did. A product that makes breaches hard, if not impossible, makes the world better.

Why developers would give up God mode

Anthony made the point developers don't like to hear. Every auth service and every major app has a mode where an admin can impersonate a user and see exactly what they see. Sometimes it's used to chase a bug. It's also free rein over everyone's data, and OpenSecret removes it, because the developer's code never gets the raw data.

Not every developer wants that. Mark said that of the 20 or 30 developers they talked to, it split about 50/50. Half wanted stronger privacy, and the other half either sold user data as part of their business model or worked somewhere like education where the institution needs access to everything.

Mark doesn't think developers have to choose all or nothing. From his time at Apple he knew the industry treats personal information in tiers, from an email address up to health and medication data. His pitch is to start with everything locked and open up only what the app truly needs, the reverse of how most apps are built today.

Anthony wants sharing to be explicit, too: share a resource with a friend, or let an app use your location to warn you about a storm. I took that one step further on tape. If a company wants your data for ads, let it ask you, and pay you something like 500 sats over Lightning if you say yes. Mark liked that because then it really is your data to sell.

The pitch that lands with developers is speed. Mark told a story about one of the biggest journaling apps, which had spent about a year and a half building its own private-key encryption across iOS, Android, and web. When they heard what OpenSecret does, the developer said it would have taken about two weeks.

Anthony said the confidential computing platforms they had looked at were all built for large enterprises, the kind of deal that starts with a six-figure contract. OpenSecret goes bottom up, starting with any developer who wants to secure their users' data. From there, the goal is fintech, health data, and eventually school systems.

They also built off-ramps. The server code is open source, and developers can keep encrypted backups of their data, so if OpenSecret ever disappeared an app could point at its own copy and keep running.

Maple was the proof. It went public on January 28, 2025, and Anthony said it picked up five or six hundred users in its first couple of weeks with almost no support requests, because it feels like any other chat app. The security model can also flex with the stakes. A coffee-money wallet might be fine behind a Google login, while an app holding generational wealth could require a passkey and email on top and hold only one key in a multisig.

Mark closed with the line I keep coming back to:

A more open internet needs to have strong privacy, so we as individuals need to be able to lock things down in order for us to feel more free to communicate online.

Maple has grown a lot since then, and in 2026 it rebranded as a personal intelligence platform. Mark came back on the show twice more: on the surveillance built into closed AI, and on what AI agents do when you give them your computer.

About Mark Suman and Anthony Ronning

Mark Suman and Anthony Ronning co-founded OpenSecret, the privacy platform behind Maple AI, after the two worked together at Mutiny Wallet. Mark joined the Mutiny team in June 2024 and is a former Apple software engineer who worked on privacy and machine learning. Anthony is OpenSecret's CTO and wrote much of the platform's code.

Sources mentioned

• Bitcoin Magazine, Mutiny Wallet raises preseed funding: the 2023 round Ten31 took part in
• Mutiny Blog, Mutiny Wallet is shutting down: the August 2024 announcement
• OpenSecret, Introducing OpenSecret: the backend that turns private encryption on by default
• OpenSecret, Maple AI backend and OpenSecret technicals: Nitro Enclaves, GPU enclaves, and verifiable builds
• AWS, Nitro Enclaves: isolated compute with cryptographic attestation
• NVIDIA, confidential computing on H100 GPUs: general availability in April 2024
• Apple Security Research, Private Cloud Compute: the research environment Apple opened to outside experts
• The Guardian, the PRISM revelations: the Snowden documents on data at rest
• NBC News, officials urge encrypted apps after Salt Typhoon: the December 2024 guidance
• DHS, the 2019 letter to Facebook on encryption: the government's earlier position
• MIT News, identifying people from credit card metadata: four purchases, 90% of people
• Anthropic, Clio: the usage research Anthony criticized
• Latent Space, o1 isn't a chat model: Ben Hylak on prompting reasoning models
• NVIDIA, xAI Colossus built in 122 days: the Memphis supercomputer we discussed
• OpenSecret, Maple AI is publicly available: the January 2025 launch

Watch the conversation

Timestamps

• 0:00 - Intro
• 0:36 - Positive vibes
• 3:37 - Grok 3
• 7:16 - Tony's approach to AI
• 12:28 - How AI will change jobs
• 16:48 - The art of prompting
• 24:08 - Using AI to build OpenSecret
• 29:39 - From Mutiny to OpenSecret
• 36:13 - Issues with security
• 47:40 - Explaining secure enclaves
• 53:22 - Shifting the relationship with user data
• 1:02:14 - Problems with "private AI"
• 1:13:16 - UX
• 1:19:54 - How much AIs know about you
• 1:25:59 - If you're not paying attention
• 1:27:47 - App developer reactions
• 1:30:35 - Try it yourself

Sponsors

• Fold: a Bitcoin rewards credit card that earns you bitcoin back on everyday spending. tftc.io/fold
• Bitkey: a Bitcoin hardware wallet built into a 2-of-3 multisig, with one key on the device, one on your phone, and one held by Block. bitkey.world
• Unchained: collaborative multisig custody and Bitcoin financial services. unchained.com/tftc