Business Plan
Curate Your Brain. A privacy-first, US-resident messenger built around a clear, honest threat model — and a slow, deliberate climb toward super-app surface area.
This document is the strategic frame for Kimosabe.AI. It pairs with ROADMAP.md (what we build) and REQUIREMENTS.md (what each release must satisfy).
1. Mission
Give Americans a daily-driver messenger that the operator cannot read, that does not require a phone number, that does not upload contact graphs, and that is honest about what it does and does not protect against.
2. Vision (5-year)
A US-headquartered, privacy-first communications layer that scales from 1:1 chat → group chat → encrypted feeds → P2P payments → AI-agent participation, without ever weakening the "server can't read your messages" guarantee.
3. Values (the non-negotiables)
- Server-blind by default. If a feature requires plaintext on our servers, we redesign or skip the feature.
- Honest threat model. Every limit we have is published at
/trust. - Minimum viable metadata. Email + username only. No phone, no address book.
- No backdoors. Ever. If forced by law, we sunset the affected feature rather than weaken it.
- Ship in slices. Phase 1 must be a real, daily-usable product before Phase 2 starts.
4. Market
TAM / SAM / SOM (US-anchored)
| Layer | Definition | Estimate |
|---|---|---|
| TAM | US adults using a messaging app daily | ~230M |
| SAM | US adults who have changed messenger over privacy concerns or distrust of "big tech" in last 24 months | ~35–45M |
| SOM (Y3 target) | Privacy-curious early adopters acquired via word-of-mouth, creator partnerships, and the trust narrative | 1–2M MAU |
Numbers are top-down planning estimates and will be replaced by a rigorous bottom-up market sizing before any institutional fundraise.
Ideal Customer Profiles
- Privacy-curious professional (lawyer, journalist, founder, healthcare admin) — wants a Signal-grade tool that doesn't require giving every contact their phone number.
- Family organizer — wants a clean group thread for family logistics that won't be data-mined for ads.
- Creator + close-circle — wants a "VIP channel" for ~50–500 fans without exposing identity to a platform.
- AI power-user — wants their agent (Hermes / OpenClaw / Agent Zero) to participate in conversations as a first-class encrypted member. See
AGENTS.md.
Competitive landscape (honest read)
| Product | Strength | Why a switcher chooses Kimosabe |
|---|---|---|
| Signal | Gold-standard E2EE | We don't require a phone number; native AI-agent contract; super-app roadmap. |
| iMessage | Frictionless on Apple | Cross-platform, web-first, no walled garden. |
| Ubiquity | Not Meta. No business-API surveillance surface. | |
| Telegram | Speed, channels | Default E2EE on every chat. No MTProto. |
| Session | No phone, no email | We have a real account model so social features (mentions, presence) work without burning anonymity. |
| Matrix / Element | Open, federated | We optimize for consumer UX; Matrix optimizes for federation. |
5. Positioning
One-liner: Curate Your Brain. The American messenger that can't read you.
Three-pillar narrative:
- Server-blind. Your messages encrypt in your browser before they ever leave your device.
- Phone-number-free. Just an email + a username.
- Honest. A public threat model — not marketing.
6. Monetization
Free tier (always)
- 1:1 + small-group E2EE chat
- Encrypted attachments up to 25 MB
- Disappearing messages
- Recovery key
- Installable PWA
- One AI agent per account
Pro — $5 / month or $48 / year
- Larger attachments (up to 1 GB)
- Encrypted voice notes (Phase 2)
- Custom username (early reservation)
- Up to 5 agents per account
- Verified identity badge (Phase 3, via OIDC attestation)
- Priority support
Business — $12 / user / month
- SCIM provisioning
- Audit log (encrypted to admin keys only)
- Domain-verified workspace usernames (
@alice@acme.kimosabe) - BAA available (Phase 5, post-SOC 2)
Agent-as-Service — usage-based (Phase 6)
Users who don't want to host their own agent can run one on Kimosabe-managed infrastructure. The agent has its own keypair and authenticates as a normal user — we never hold decryption keys for the human. Pricing: per-token compute pass-through + 20% margin.
Explicitly off the menu
- Selling user data — never.
- Plaintext-aware advertising — impossible by design.
- Government / operator backdoor access — never.
7. Unit economics (planning model)
| Metric | Year 1 | Year 3 target |
|---|---|---|
| MAU | 25k | 1.5M |
| Paid conversion | 2% | 5% |
| ARPPU (blended Pro+Business) | $60 / yr | $84 / yr |
| Infra cost / MAU / month | $0.18 | $0.09 |
| Gross margin | 70% | 85% |
| CAC (mostly word-of-mouth + creators) | $2 | $4 |
These are planning targets, not forecasts. Replaced by actuals starting Phase 2.
8. Go-to-market
Phase 1 (now → +6 months)
- Soft launch on Hacker News + Lobsters with a focus on the published threat model.
- "Switching from Signal" + "Switching from iMessage" deep-dive blog posts.
- Direct outreach to 100 privacy-focused creators with founder-tier reservations.
Phase 2 (+6 → +18 months)
- Group chats unlock the "family + close circle" use case.
- Creator partnership program — handpicked creators get verified handles + a public landing page.
- Sponsorship of OWASP / privacy conferences.
Phase 3 (+18 → +36 months)
- Native app launch (Phase 4 of product roadmap) → app-store discovery.
- B2B pilot program for law firms + healthcare admins.
- SOC 2 Type II.
9. Funding posture
- Bootstrapped through Phase 1. Lovable + Cloudflare keeps run-rate near zero.
- Seed at Phase 2 milestone: group chats live, 25k MAU, paid tier converting.
- Series A at Phase 4 milestone: native app shipped, mesh demonstrated, audited.
We will not take capital from sources whose business model is incompatible with E2EE.
10. Risks & mitigations
| Risk | Mitigation |
|---|---|
| US legislation banning E2EE | Public commitment to sunset rather than weaken; legal counsel on retainer; relocate jurisdiction if needed. |
| Apple / Google PWA hostility | Native app is on the roadmap (Phase 4) and shares identity keys. |
| Crypto vulnerability disclosed in a primitive we depend on | We use only standard primitives with multiple vetted implementations; rotation plan documented in SECURITY.md. |
| Recovery-key UX failure (user loses both password and key) | Education at signup; download + email-the-key flow; explicit warning that history is unrecoverable. |
| Spam / abuse on a metadata-blind network | Per-user rate limits + recipient-side allow-lists + reportable handles (report includes ciphertext + complainant decryption). |
| Founder bus-factor | All architectural and brand decisions live in this repo, not in heads. |
11. Brand
- Name: Kimosabe.AI
- Wordmark: "Kimosabe" in Inter, antique gold on deep purple.
- Mark: Metatron's Cube — the unifying geometry of all five Platonic solids; chosen because privacy is a structural property, not a feature.
- Voice: Direct, calm, slightly old-school. Never "disrupt." Always "build."
- Tagline: Curate Your Brain.
Design tokens live in src/styles.css. Do not introduce raw hex.
12. Decision log
Material strategic decisions are recorded as ADRs in docs/adr/. Brand or pricing changes go through an ADR even if no code changes.