What we do, and what we don't.
This page is not marketing copy. If something isn't written here, we don't do it.
Where the data lives
After install, your workspace sits in encrypted storage on your device. Sync ships switched off, so nothing leaves on its own.
- Notes, tasks and files in local storage
- Vault records encrypted separately, masked even in the list
- The nightly snapshot on the same device
What happens when you turn sync on
Turning sync on is an explicit decision. From that moment, settings show which workspace is being synced; turn it off and syncing stops while your local copy stays where it is.
What the AI can reach
AI help is off by default. Switched on, it reads only the notes relevant to your question, and the answer names the note it used. Vault records are outside that scope — they are not read unless you open them.
Payment data
We don't see your card number. Payment is handled by iyzico in Turkey and Paddle elsewhere, and card details never reach us.
What we don't promise
The following is true today. When it changes, this page changes.
- Alpha 0.4 is not a stable release; the data format is still moving
- No independent security audit yet — scope and auditor agreement drafted, no report
- End-to-end encryption is not complete for every scenario
- Don't keep your only copy here; Markdown export works today
OpenAI API Key
sk—••••••••••••9f3a
Postgres · production
••••••••••••••••
If you find something
Report a vulnerability directly. We ask for a reasonable window to fix it before public disclosure; tell us what you found and how to reproduce it.