07 Privacy The whole argument

What Never Leaves

Private document storage, explained

Every app claims to respect your privacy. Here is the mechanism, and the parts that are less tidy than the slogan.

Every app says it’s private. This one is holding my passport, my payslips and my bank statements. What actually stops someone reading them?

— a fair question to ask of any vault

64 MBMemory every single password guess must pay for.
5 → 5 minWrong attempts before unlocking locks out.
3 doorsPassword, recovery key, Touch ID — onto one key.

Your master password is never stored. It goes through a deliberately slow calculation, and what comes out unwraps the vault key. That slowness is the point: it makes guessing expensive even for someone holding your disk.

Three ways in, all unwrapping the same vault key, which in turn protects the documents, the database and the saved secrets Master password slowed by Argon2id Recovery key the spare door Touch ID held by the hardware The vault key only ever in memory Your document files each with its own key The database itself text, dates, everything read Saved secrets passwords, cards, PINs FIVE WRONG GUESSES LOCKS UNLOCKING FOR FIVE MINUTES
Three doors, one key. It also means losing all three doors loses the vault — there is no fourth way in held by anyone else, which is the same fact stated from the other side.

What crosses the boundary

Reading your documents, pulling out the dates and building the search index all happen here, with models on your own disk. Four things can reach the network, and you control every one.

Everything the app does stays inside the machine; four optional things can cross the boundary, none carrying documents YOUR MACHINE Documents and their text Reading pages (OCR) Pulling out dates and providers The search index Saved passwords and cards The AI models themselves NONE OF IT LEAVES Licence check A licence key. No documents. Google Drive import Only files you pick, when you pick. SMS / WhatsApp reminders Only what you put in the reminder. Crash reports, analytics Off unless you switch them on.
The models download once, on demand. After that the machine can be offline permanently and everything still works.

The limits, stated plainly

A privacy page that lists only strengths is marketing. Three things are worth knowing.

The keyword index holds words

Searching for a word means the words have to be stored somewhere searchable — you cannot build a keyword index over scrambled text. That index lives inside the encrypted database, so it is protected by your master password like everything else, but within the database it is readable text rather than ciphertext.

Unlocked means unlocked, until you quit

Locking the vault clears your keys from memory and hides your data behind the password again. The underlying database connection, though, stays open until you quit the app. Auto-lock protects you from someone walking up to your desk; quitting is what puts everything fully back in the box.

Nobody can help you get back in

No password reset email, because there is no account. This is the direct consequence of the good part — the same absence of a company holding your key is why nobody can be compelled to hand it over.

Checking it yourself

  • Open the vault file in a text editorYou should see nothing readable. If you can read your paperwork, something is wrong.
  • Pull out the network cableImport, read, search, open. All of it works offline.
Settings→ Privacy & Diagnostics→ check what is switched on

The short version

Your documents are encrypted with a key only your password produces. The reading and understanding happen on your machine. What leaves is a licence check and whatever you explicitly ask to send. The cost of that design is that you are genuinely the only one who can get in — which is why articles 01 and 06 spend so long on the recovery key and the backup.