Lotti: an encrypted logbook where AI agents propose and you approve

The problem Lotti solves: keeping intent and reality as separate facts

Most task managers collapse two different things into one list. A task is an intention: an outcome you want. A time record is a fact: what actually happened, with the notes, photos, recordings and measurements attached to it. The README states that Lotti keeps these apart on purpose, so that the record stays honest when a week does not go to plan. That distinction is the reason to look at this project rather than a to-do app. A task in Lotti can be planned into a block, and a separate time record captures what you did instead. The two are related but not merged. The README says the author has tracked around 11,000 hours of his own work in it since 2022, which is the kind of claim you can only make about a tool that has survived years of daily use. The audience is narrow and identifiable: people who want a private logbook of their own work, who care about who can read it, and who are willing to run a Flutter application across their own devices rather than sign into someone else's service. If you want a shared team task board, this is not that.

Agents propose, the storage layout decides

The agent design is the part worth examining closely. An agent reads a task, forms an opinion, summarises a mess and suggests a next change. According to the README, that report is an opinion with provenance, not a new fact in your history. Task, checklist, status and date changes wait for you to confirm or dismiss them. The README says this is enforced by the storage layout rather than by careful prompting, and points to a section titled Two databases: human in the loop by construction. That is a meaningful architectural claim: if the agent writes into a separate database from the one holding your confirmed history, then a misbehaving model cannot corrupt the record by prompt injection or by drifting. The single exception the README names is an initial title or language for an otherwise empty task. The screenshot alt text shows the interface: a task agent's report with two proposed changes, each with a dismiss and a confirm control, plus Confirm all and an automatic-updates toggle. So the automatic-updates toggle is the escape hatch for people who want the agent to act without per-change confirmation. I cannot verify from the supplied material how the two databases are reconciled, what schema separates them, or whether the automatic-updates toggle bypasses the same enforcement. Those are the questions to answer before trusting the guarantee.

Sync, ciphertext and what the relay actually keeps

The privacy model is stated plainly in the README: your logbook lives on your devices, sync is end-to-end encrypted, and the relay you choose holds only ciphertext, not forever. The interesting part is the second half of that sentence. Nothing depends on the relay keeping anything, because a new device catches up when your other devices re-send history rather than because a server archived it. That is a real design decision with a real consequence: your other devices have to be online and reachable for a new device to fill in. A relay that stores nothing is also a relay that cannot recover your history if every device you own is lost. The README also states there is no telemetry and nothing uploaded to Lotti. The sync transport is not named in the README, though the repository topics include matrix, which suggests Matrix is involved in the relay layer. I cannot confirm the exact protocol from the material provided, so treat that as something to check in the manual rather than a settled fact.

Getting it running: install paths and the AI setup you choose

Installation differs by platform, and the README is explicit about which ones are finished. On Linux, Flathub is recommended, or you can take a tar.gz from the Releases page. On macOS there is a signed and notarized DMG on Releases. On iOS, iPadOS and macOS, TestFlight is described as limited and invitation only, with broader availability planned. On Android, there is an APK on Releases, or Play Store internal testing, also described as limited and invitation only. Windows has no packaged build: the README says to build from source and points at docs/DEVELOPMENT.md. The AI layer is optional and configured by you. The README says you route each category of your life to the compute you are willing to stand behind: a local model for private things, a frontier model for work, or the European option Lotti recommends. The usage view reports tokens and requests for every cloud call, and spend, energy and CO2e for providers that report them, which the README says today means Melious. Local inference is not measured at all, because the cost moves onto your own hardware and grid. Audio capture is transcribed locally with Whisper, which the README says covers 99 languages, or with Voxtral, or through a cloud provider with audio support.

Where Lotti is the wrong tool

The most obvious limitation is platform coverage. Windows users have to build from source. iOS and Android are invitation-only through TestFlight and Play Store internal testing respectively, so you cannot simply hand Lotti to a colleague and expect them to install it. The second limitation is the sync model itself. Because the relay holds ciphertext and not forever, and because catch-up depends on your other devices re-sending history, a new device is only as good as the peers it can reach. If you have one device and it dies, there is no server-side archive to restore from. The README does not describe a backup mechanism, so assume you need your own. The third limitation is the AI layer. It is optional, and when you do turn it on, the quality of the summaries and suggestions depends on the model you route each category to. The README is honest that local inference cost is not measured, which means you will not see it in the usage view. Anyone who wants a hosted, zero-setup experience with a vendor holding their history should look elsewhere, because that is the opposite of what this project is built to do.

The alternative: a hosted task manager with server-side history

The natural comparison is a hosted task manager such as Todoist or a calendar-and-tasks combination inside a productivity suite. The difference in approach is not cosmetic. A hosted tool keeps your data in readable form on someone else's infrastructure, which makes multi-device sync trivial, makes recovery after device loss trivial, and makes collaboration possible. Lotti inverts all three: the server sees only ciphertext, recovery depends on your own devices, and collaboration is not the point. The other comparison is a plain local notes app or a spreadsheet. Those give you the same privacy guarantee for free, but they do not separate intent from reality, they do not transcribe voice notes into tasks, and they do not run agents over your records. Lotti sits between the two: more structure than a notes file, less infrastructure than a hosted service. If you already trust a hosted provider with your calendar, the marginal privacy gain of Lotti may not be worth the operational cost of managing your own sync and backups. If you do not, the trade is the other way.

Maintenance, releases and the GPL-3.0 licence

The release cadence visible in the material is fast: three releases between 7 September and 9 September 2026, with build numbers in the 4380s. That suggests active development on the main branch, and it also means you should expect to update often if you want fixes. The README notes the project has been in development since 2016, so the fast cadence is not a young project finding its feet. On cost, there is no pricing page in the material, and the application is distributed through Flathub, GitHub Releases and TestFlight, so the software itself appears to be free to install. The costs you carry are your own: the hardware for local inference, the electricity for it, and whatever you pay a cloud provider if you route categories to one. The licence is GPL-3.0. That matters if you intend to modify Lotti or ship it inside another product, because the GPL imposes obligations on derivative distribution. I am not a lawyer and this is not legal advice; if you plan to redistribute a modified build, read the licence text in the repository and get proper advice. For individual use, the licence is unlikely to change anything about how you run the app.

Editorial conclusion

Adopt Lotti if you want a local-first record of what you planned and what actually happened, you are comfortable running a Flutter app on macOS, Linux, iOS or Android, and you accept that AI is optional and that proposed agent changes always pass through your approval. Do not adopt it if you need a Windows build today, if you want a hosted service that keeps your history server-side, or if you expect agents to act without confirmation. Before committing, verify on your own machine that the relay you choose actually syncs a second device, that the Whisper or Voxtral model you intend to use runs locally at acceptable speed, and that your chosen cloud provider is one of the ones whose token, energy and CO2e figures the usage view reports.

Official sources

1. License: GPL-3.0
2. matthiasn/lotti on GitHub
3. Project website
4. README
5. Releases