Security
Who can read your data.
The short answer is you. The long answer is below, including the places where it stops being quite so short.
This page answers the questions you ask a vendor before handing over an address book. It is deliberately technical and deliberately boring. Where something does not exist yet it says so — Endearist has not launched, and a security page implying a running service would be the first dishonest thing on a page whose entire value is not having any.
Where your data lives
On your device. Endearist is built local-first: the primary copy of your contacts, notes, and journal entries sits in a local database on the machine or phone you typed them into. There is no central content server holding the originals.
Sync is optional and you choose the destination: your own cloud (Google Drive, iCloud, WebDAV) or Endearist Cloud, hosted in the EU. In both cases encryption happens before anything leaves the device.
The difference from "EU servers" is worth spelling out: EU hosting answers which jurisdiction your data sits in. Local-first answers who can read it at all. The second is the harder commitment, and several rivals only make the first.
Encryption and who holds the key
When you turn sync on, content is encrypted with AES-256-GCM before it leaves the device. The key is derived from your passphrase and a 12-word recovery code, and it never leaves your device.
Adding a second device does not change that. Pairing goes through a device you already trust or through your recovery code — not through our server reconstructing your master key. The server can move encrypted packages around; it can neither read nor mint the key that opens them.
The uncomfortable other half: lose the passphrase and the recovery code and the data is gone. We cannot get it back. A vendor who can reset your password and hand your notes back was able to read them all along.
Who can see what
One at a time, without softening:
- Us: none of your content. We run no content server, and anything moving through Endearist Cloud was encrypted first. What we could see is billing data, once there is a checkout.
- Your cloud provider (if you use your own): opaque bytes and their size. Google Drive or iCloud can see a file exists, not what is in it.
- Anyone holding your unlocked device: everything. Local-first means device security is the foundation — a screen lock and full-disk encryption are part of the model, not optional extras.
- Your AI provider, if you add your own key: exactly the text you submit for one action. Not your database. Without a key nothing goes to a model at all.
- A government with a warrant: from us it can only obtain what we hold, and we do not hold content. A warrant against your device or your cloud provider is a different question, and not one we can answer for you.
What this website does
No Google Analytics, no Facebook Pixel, no Hotjar, no embedded social buttons, no ad networks. Traffic measurement runs on a self-hosted Plausible instance behind a same-origin proxy: no cookies, no personal data, only anonymous page views.
Fonts are served by us, not by a font CDN — your browser contacts no third party to render this page. If you join the newsletter, your browser only talks to endearist.com; the handoff to the email provider happens server-side.
Exactly one third party reaches your browser, and only on the requests pages: the Tally form embed. Everywhere else the Content-Security-Policy is limited to our own domain. The full list lives in docs/csp-allowlist.md in the public repository — checkable, not merely claimed.
Every response from this site carries CSP, HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, and Permissions-Policy. If any of them goes missing, our own build fails.
GDPR in practice
The operator is a natural person in Germany (see the imprint), so the GDPR applies in full and the operator is the controller within the meaning of Art. 4(7).
The decisive point for a local-first app: there is almost nothing to process about the content in your app. What we can process at all is newsletter addresses, form submissions on the requests pages, and later billing data. Your contacts and notes are not in that set.
Access, rectification, erasure, and portability all go through hi@endearist.com. For export you do not need us at all, though: the app’s Markdown export is complete, available at any time, and behind no paywall — including when you are leaving for a rival.
A data-processing agreement is not needed for private individuals; if you want to use Endearist professionally and need one, write to us.
The honest limits
Endearist has not launched. There is no public build, no bug-bounty programme, no external security audit result, and no SOC 2 certification. If any of those is required for your decision, the right answer today is no.
Local-first also does not protect against everything. It does not protect against a compromised operating system, against someone reading over your shoulder, or against you losing your recovery code. The full account of what is inside and outside the model is on the threat-model page.
And the limit no cipher covers: what happens when the company is gone? That is why the pledge exists to release the source under an open licence on acquisition or shutdown. Clay was bought by Automattic in June 2025 and rebranded to Mesh in 2026 — in this category that is not a thought experiment.
Common questions
- Can you read my notes?
- No. Content sits on your device, and anything moving through sync is AES-256-GCM encrypted before it leaves. We do not hold the key — it is derived from your passphrase and your 12-word recovery code and never leaves your device.
- What happens if I lose my passphrase?
- The 12-word recovery code gets you back in. Without either of them the synced data is unrecoverable, including by us. That is the necessary flip side of us not being able to read it.
- Is my data in the EU?
- Your data lives on your device first, so wherever you are. If you use Endearist Cloud for sync, that is EU-hosted. If you use your own cloud, your provider decides the location — in both cases the content is encrypted first.
- Has Endearist been audited or certified?
- No. There is no external security audit, no bug bounty, and no SOC 2 certification, because the app has not launched. If you need certification, do not bet on us today.
- Which third parties are involved?
- In the browser, exactly one: the Tally form on the requests pages. Analytics is self-hosted, fonts are self-hosted, and the newsletter provider is contacted server-side. The full list is in docs/csp-allowlist.md in the public repository.
- How do I get my data out?
- Through the app’s Markdown export. It is complete, available at any time, and behind no paywall — including when you are leaving for a rival. Plain Markdown is readable in any editor, including in ten years.