Verifiable Privacy

Don't take our word for it.
Read the code.

Here is the technical detail behind how we protect your conversation history. No marketing. No trust-me promises. Just math and open source code.

// Architecture

The Trust Boundary

Your Device

Your password
Derived encryption key (memory only)
Plaintext messages
Encryption & decryption

ciphertext at rest

stored as ciphertext

Our Server

Encrypted ciphertext blob
Salt (not the key)
Iteration count
No stored key. Saved history stays ciphertext.

Note: your saved conversation history is encrypted on your device and stored as ciphertext. Live prompts you send for a model to answer travel over TLS to run inference — these are not retained for training.

// Specification

Algorithm Specification

Property	Value
Encryption	AES-256-GCM (authenticated encryption)
Key Derivation	PBKDF2 — 600,000 iterations, SHA-256
Initialization Vector	12 bytes, cryptographically random, unique per message
Salt	16 bytes, cryptographically random, unique per user
Key Storage	In-memory only (JavaScript variable)
Key Persistence	None. Cleared on logout or tab close
Dependencies	Zero. Web Crypto API only
Ciphertext Format	Base64( IV \|\| ciphertext \|\| GCM-auth-tag )

// Evidence

Five Proofs

Open Source Code

Every line of our encryption is public. Read it, audit it, run the tests.

View on GitHub →

Database = Ciphertext Only

Your saved history is stored as opaque encrypted blobs. We cannot decrypt them — and nobody can without your password.

See database proof →

Network Traffic Proof

Open your browser DevTools and watch the network tab: saved conversation history syncs as encrypted blobs. Live prompts go over TLS for inference and are not retained for training.

Watch demo →