We promise.

Local-first vault, fully offline: not publicly available yet. Status: planned for v1.

The vendored app measurement does not confirm an encrypted local database. It records an unencrypted SQLite file; an app lock does not encrypt that file. Protect your device and backups independently.

End-to-end encrypted sync over storage you run yourself — a local or shared folder, or a WebDAV server — is planned for v1. Google Drive as a destination is not decided yet. Managed sync on Endearist Cloud is planned for after v1, as part of the Pro Cloud subscription only.

This website uses Plausible Analytics — our own self-hosted instance. Plausible collects no cookies, no fingerprints, no personal data. What we see: how many people visited a page and which country they came from. Not who. Not how long. Not where they went next.

No Google Analytics. No Facebook Pixel. No Hotjar. No retargeting scripts. We have no embedded social buttons that report your visit to third-party servers. When you visit our website, nobody outside our team learns about it — and we only learn it as an aggregate number, not as your profile.

Inside the app itself, there is no telemetry transmitted without your explicit consent. If we ever add opt-in crash reporting, it will be exactly that: opt-in. The default setting is silence.

We make no money selling your behavior. Our only business model is that you buy the app — because it's good enough that you want to.

Proposed plan, not purchasable yet: local app and AI with your own key (planned for v1). Sync over your own storage is planned for v1. Managed cloud services are not a lifetime feature.

Proposed plan, not purchasable yet: managed AI (planned for after v1, as part of the Pro Cloud subscription only) and Endearist Cloud (planned for after v1, as part of the Pro Cloud subscription only). Specific budgets, routing and prices require approval. Family sharing: not decided yet; no included family seat is promised.

Our aim is to fund recurring infrastructure separately from local software purchases. Further upgrade discounts are not an approved purchase entitlement today.

Endearist is independent and self-funded. No venture capital, no outside investors, no acquisition discussions. This isn't a romantic pose — it's a deliberate decision, because VC funding and privacy-first products are structurally hard to reconcile. VC needs an exit, exit usually means acquisition, acquisition often means: new owner, new business model, new data policy.

You know the stories: Clay was acquired by Automattic and became Mesh. Accompany was bought by Cisco. Every time, users were left asking: what happens to my data now? Will I get notice if the privacy policy changes? Can I still export before the service shuts down?

Our promise: if we ever sell Endearist, we will announce it in advance. We will give an export period of at least 90 days. And the app code and data format spec will become public domain. No lock-in after the lights go out.

If we shut down without an acquisition: same rule. 90 days notice, full export, open-source release of the core. Your data belongs to you — even if we stop existing.

Markdown, CSV and vCard export: not publicly available yet. Status: planned for v1. The documented implementation has a separate readable ZIP export with media and a report of omissions; legacy exports remain partial. This is not device or release acceptance.

Our commitment: reading, export, backup and restore should not depend on a running subscription.