A private, encrypted notebook and journal. There are no accounts — no email, no sign-up, nothing about you on any server.
Three unrelated words beats one clever one.
Enter your passphrase to unlock — it only decrypts what is already here, on this device.
This passphrase isn't on the approved list yet.
No code? Ask whoever told you about this for one — or request access by hand and wait for the owner to approve you.
This vault has saved notes before, but the store is empty now. That usually means the browser cleared this site's storage to free space. Nothing you restore here leaves this device.
Checking…
Browsers may silently delete a website's storage when the device runs low on space. "Protect storage" asks this browser to promise not to. The request is answered on this device — nothing is sent anywhere.
Checking…
A backup is the only copy of this notebook that survives a lost, broken or wiped device. It is encrypted on this device before it leaves; the server stores ciphertext it cannot read.
There are no accounts here, so there is no reset and no recovery email — nobody can give your notebook back if the passphrase is lost. This one page is how you make sure that never matters: print it or save it, then fill in the three lines with a pen.
The page shows your public address and a checklist — it never contains a passphrase, and generating it makes no network request. Write the secret halves with a pen, on paper, and keep the paper somewhere a phone is not.
Theme, accent colour, text size, spacing and the font your notes are set in — all in one place, all applied as you choose them.
Off — everything stays only on this device.
Only what you tick above is uploaded, and only ever as ciphertext the server cannot read. With notes ticked, this is also sync: unlock the app on another device with the same passphrases and your notes merge together — deletions included. The server holds one encrypted blob it cannot open, and nothing else. 🔒 Messages other people sent you always stay on this device — they're never uploaded, even encrypted.
Publishing a username stores a public username → address lookup on the server so others can message you without hex. Turn it off to remove it. Your messages stay end-to-end encrypted either way.
Shows a system notification for incoming direct messages while the app is installed and running in the background. You'll be asked for permission once.
The push itself is empty — it carries no message, no name and no preview, so the push service in the middle learns nothing beyond "something arrived". Your device then fetches and decrypts locally. The app keeps checking on its own schedule either way; this only adds the closed-app wake-up.
Locking clears your unlocked identity out of memory — not just off the screen — so a locked app can't read your mail, can't be poked at from a browser console, and needs your passphrase again. When the app goes into the background it also covers itself, so your messages don't end up in the phone's app-switcher preview.
Off unless you set one. A second passphrase opens a separate, empty vault on this device — its own notes, its own contacts, its own history. If someone makes you unlock this app, you can give them that passphrase instead. It looks exactly like the real thing, because it is the real thing, just not yours.
Read this before you rely on it. This defeats a demand to "unlock your phone". It does not defeat someone who takes a forensic copy of the device, or who already knows this feature exists and won't take the first answer. The second vault is local-only — it can't send or receive real messages — so it holds up to being looked at, not to being used for an hour. Give it some notes and contacts of its own over time; an empty vault is not a convincing one. And if you forget which passphrase is which, there is no recovery: nothing on this device records which is which, on purpose.
An invite code lets one person in without waiting for anyone to approve them. Each code works once.
Wrote nothing worth keeping today, which is also a kind of entry. #journal
A quieter line — timestamps, hints, counts.
Monospace is the house style, and it is also hard work to read at length. The dyslexia-friendly setting widens letter and word spacing and uses OpenDyslexic or Atkinson Hyperlegible if you have one installed — nothing is downloaded, because nothing in this app is ever downloaded.
How wide a line of your own writing is allowed to get on a big screen. Full lets it use the whole window.
These settings live on this device only. They are never uploaded, they are the same in every vault on this phone, and they are applied before the first frame is drawn so there is no flash of the wrong theme when you open the app.
Send an encrypted direct message. Enter a @username, pick a saved contact, or paste a key (64 hex chars). Easier still: tap “Share my invite” below and text someone the link — one tap adds you to each other. Messages land in Messages, which checks itself automatically — never in your notes.
Point your friend's phone camera at this — it opens a link that adds you both. Or send the link any way you like.
Stored only on this device, encrypted at rest and searchable. Nothing is uploaded unless you turn on “Also back up my notes” in Settings.
A group is a conversation, not a mailing list — everyone sees everyone's replies in one thread. There is no group on the server: your device encrypts a separate copy of each message to each member, so the relay only ever sees unrelated envelopes.
Deleting removes it from this device only. Nothing here can reach into somebody else's phone, and a button that claimed to would be lying.
There are no accounts here. Your passphrase does exactly one job: it decrypts a vault on this device holding your address, your message keys and the key your notes are encrypted with. It is never sent anywhere and it is never stored — not even as a hash.
There is no reset and no recovery. Nobody can send you a link, because nobody knows who you are. If you forget it, the notes on this device stay encrypted forever.
So do one of these, today: Export key writes an encrypted copy of your identity that you can keep somewhere safe or load onto a second device; Export → encrypted archive does the same for your notes.
Writing a note makes no network request at all. Nothing is uploaded unless you turn on cloud backup, and messages other people sent you are never uploaded even then.
Messages are end-to-end encrypted, and the sender's identity lives inside the encryption rather than beside it — the relay sees an envelope, a recipient and a time, and cannot tell a message from a read receipt. What it can still see: which address has mail, when, how much, and the sending IP.
A group has no existence on the server. Its membership list lives on each member's device and rides inside the encryption of every message, so anyone who has been offline catches up automatically. Anyone can add or remove anyone; there is no admin, because an admin would have to be recorded somewhere.
“Left the group” is a claim your device makes and theirs honours. It is not enforced by anything, because there is nothing in the middle to enforce it. Blocking somebody individually is the control that actually holds.
⌕ searches everything on the device at once — notes, messages you
sent, messages you were sent. Combine from:sarah, tag:garden,
has:link, is:unread, last march,
on this day in any order. Anything it does not recognise stays as
plain words, so it never quietly turns your search into something else.
⌘K opens the command palette. Esc closes whatever is on top.
Settings → Second passphrase sets up a separate vault that opens with a different passphrase. It is off unless you set it, and nothing on this device records whether you have. Read the limits there before you rely on it.
Every tag on this device, most used first. Tap one to see its notes.
This writes a decrypted copy of your whole notebook to your device. Once it exists it is an ordinary file: readable by every app that can see your downloads, indexed by your operating system, swept up by whatever backs that folder up, and no longer covered by your passphrase, the auto-lock or the second passphrase. That is not a reason never to do it — it is the only format that will still open in thirty years — but do it deliberately, and put the file somewhere you would be willing to leave your diary.
One document, with each note preceded by its own front matter carrying the date and its tags. Splits cleanly into one file per note for anything that wants them that way.
Everything: notes, contacts, conversations, groups and settings — in one file, encrypted on this device with the passphrase you choose below, and re-importable here or on a new device. Your identity is not in it; that is what “Export key” is for, deliberately kept a separate act.
There is no recovery. If you lose the passphrase, the archive is noise.
Write something to yourself and pick a date. It leaves the feed, the search and your stats, and comes back on the day — no server, no reminder scheduled anywhere, just this app checking the date the next time you open it.
Honestly: sealed means this app will not show it to you. Notes live on this device unencrypted, so it is hidden, not locked — the same limit everything else in your notebook has.
Every number came from this device. Nothing was uploaded to work it out, and nothing will be unless you choose one of these:
Saving puts a picture of your year on this device. Sharing hands that picture to whichever app you pick — after that it is theirs, and this app can no longer promise you anything about where it goes.