Lluma
Prompt and identity, permanently linked
1:1
Bodegga · Anonymous inference
Ask anything.
Leave no trace.
Anonymous, peer-to-peer LLM inference. No relay, broker, or host ever holds both who you are and what you asked.
peers·1,204 · median·31ms · requests·anon
The problem
Your AI chats aren't private.
Every prompt you send is tied to your account, stored next to your identity, and quietly used to build a profile of you. The provider doesn't just answer your question — it remembers who asked.
Retention windows you don't control
∞
One party holds the whole picture
1
The guarantee
No single party ever holds both who you are and what you asked.
Relay
- Sees: your IP address
- Never sees: your prompt — it stays encrypted
sees: ip
Broker
- Sees: ciphertext and routing metadata
- Never sees: who you are
sees: ciphertext
Host
- Sees: the decrypted prompt
- Never sees: your identity
sees: prompt
Being honest about the limits: on the Open tier, the host that runs your model can read your prompt — it just has no way to link it back to you. If you want the host blind to content too, choose the Confidential tier, which runs inference inside a hardware-attested enclave the operator can't inspect.
How it works
Four hops. No single witness.
Prove without revealing
A blind-signed token proves you're entitled to a request without revealing who you are.
Route through a relay
Your request passes through a relay that sees your IP address — never your prompt.
Matched by a broker
The broker matches you to the nearest fast host by latency. It sees ciphertext, not you.
Answered by a peer
A volunteer host runs the model and streams the answer back. It sees the prompt, never you.
The network
Torrent for intelligence.
Content-addressed weights
Model weights move like torrents — content-addressed with BLAKE3, seeded peer to peer across the network.
blake3
Whole model, one host
Each individual request still runs the whole model on one nearby host, so answers stay fast and coherent.
1 host / request
Self-healing & beaconing
If a host drops mid-download, the tracker just points peers elsewhere — the same latency beaconing that seeds routing keeps the mesh honest about who's actually fast right now.
heartbeat·5s
Contribute
Contribute before you consume.
Lluma runs on skin in the game, tiered to whatever hardware you've got. Everyone puts something in before they take something out — no leeching.
★ ★ ★
Host a model
Run inference for the network on your GPU. The biggest contribution earns the most credit.
earns ★★★
★ ★ ☆
Seed + relay
Help distribute model weights and relay encrypted traffic for other peers.
earns ★★
★ ★ ☆
Donate an API key
Contribute spare capacity from a commercial provider key you already have.
earns ★★
Trust tiers
Choose your tier, per request.
Open
Any GPU · unlinkable · signed no-log software
Runs on any volunteer host. The host can read the prompt it's asked to answer — it just has no way to connect that prompt to you. Host software is signed and built to keep no logs.
tier: open
Confidential
TEE-attested · operator-blind
Runs inside a hardware-attested trusted execution environment. Even the person operating the machine can't see the prompt or the answer.
tier: tee
Get started
Join the mesh.
Run a node, contribute capacity, and help carry inference that no one can trace back to anyone.
Run a node$ lluma run-node — coming in the app