The journey in plain words: what stays on your devices, what leaves them, when, and why. The full policy is at the bottom of the page, and says the same thing at much greater length.
With the local model on a computer, nothing leaves at all. If you sort with your Anthropic key, the text of your capture goes to Anthropic when it is sorted, then the result comes back to you. That is the only thing that leaves.
Nothing to create. We do not have your email, so we do not have a list.
No space sold, no profile built behind your back.
Nothing that follows what you do in the app.
We do not know how often you open the app, or what you look at in it.
This is not generosity: it is what happens when there is no server in between. Even if we wanted to, we would have nothing to look at.
Your two devices exchange their keys directly: a QR code to scan, or six digits to type. Then they catch up with each other over your Wi-Fi.
Syncing over your Wi-Fi is encrypted, and not just encrypted: each device only talks to the exact certificate it remembered during pairing. Another device on the same network cannot pretend to be yours, and the unencrypted link has been closed for good.
This is the page people will quote against us. Nothing on it is approximate.
Your memory is a file on your device. Uninstall, delete it, and nothing is left anywhere. Because there is no anywhere else.
Your memory is a file on your device: copy it and take it with you, with no account to close.
The engine is public: everything this page says can be checked in the code, line by line. You do not have to take our word for it.
Public, kept with the code, and readable without creating an account. It is written in French for now.
A second brain that sorts itself, on your own devices.