Security
Who can read your data.
Local storage and encrypted sync protect different things. Here are the proposed scope and measured limits.
This page answers the questions you ask a vendor before handing over an address book. It is deliberately technical and deliberately boring. Where something does not exist yet it says so — Endearist has not launched, and a security page implying a running service would be the first dishonest thing on a page whose entire value is not having any.
Where your data is intended to live
The local core is planned for v1. The primary copy is intended to live on your device, without a central content server.
End-to-end encrypted sync over storage you run yourself — a local or shared folder, or a WebDAV server — is planned for v1. Google Drive as a destination is not decided yet. Managed sync on Endearist Cloud is planned for after v1, as part of the Pro Cloud subscription only.
Local database and sync encryption
The vendored app measurement does not confirm an encrypted local database. It records an unencrypted SQLite file; an app lock does not encrypt that file. Protect your device and backups independently.
End-to-end encryption belongs to the proposed own-storage sync design. There is no publicly approved security evidence for a running sync service; support for a storage provider alone does not verify that property.
The proposed sync should encrypt content before upload. Key management, pairing and recovery need their own approval; a passphrase or provider support alone does not prove a secure implementation.
Who could see what
In the proposed model, local content stays on your device. Sync, AI requests and support are separate data paths; approval of one does not establish the others.
- Someone with access to an unlocked device or an unprotected database file can read content. An app lock does not replace file encryption.
- For proposed encrypted sync, storage providers could still see metadata such as file sizes and timestamps. An operated cloud service is not a lifetime feature.
- AI with your own key: planned for v1. Sending selected text to an external provider is a deliberate disclosure.
- Content you deliberately paste into a support request can reach us. Website data and future billing records are separate.
What this website does
No Google Analytics, no Facebook Pixel, no Hotjar, no embedded social buttons, no ad networks. Traffic measurement runs on a self-hosted Plausible instance behind a same-origin proxy: no cookies, no personal data, only anonymous page views.
Fonts are served by us, not by a font CDN — your browser contacts no third party to render this page. If you join the newsletter, your browser only talks to endearist.com; the handoff to the email provider happens server-side.
Exactly one third party reaches your browser, and only on the requests pages: the Tally form embed. Everywhere else the Content-Security-Policy is limited to our own domain. The full list lives in docs/csp-allowlist.md in the public repository — checkable, not merely claimed.
Every response from this site carries CSP, HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, and Permissions-Policy. If any of them goes missing, our own build fails.
GDPR in practice
The operator is a natural person in Germany (see the imprint), so the GDPR applies in full and the operator is the controller within the meaning of Art. 4(7).
The decisive point for a local-first app: there is almost nothing to process about the content in your app. What we can process at all is newsletter addresses, form submissions on the requests pages, and later billing data. Your contacts and notes are not in that set.
For website data, contact hi@endearist.com. Markdown, CSV and vCard export: not publicly available yet. Status: planned for v1. The documented implementation has a separate readable ZIP export with media and a report of omissions; legacy exports remain partial. This is not device or release acceptance. Future export rights must not be blocked by a subscription.
A data-processing agreement is not needed for private individuals; if you want to use Endearist professionally and need one, write to us.
The honest limits
Endearist has not launched. There is no public build, no bug-bounty programme, no external security audit result, and no SOC 2 certification. If any of those is required for your decision, the right answer today is no.
Local-first also does not protect against everything. It does not protect against a compromised operating system, against someone reading over your shoulder, or against you losing your recovery code. The full account of what is inside and outside the model is on the threat-model page.
And the limit no cipher covers: what happens when the company is gone? That is why the pledge exists to release the source under an open licence on acquisition or shutdown. Clay was bought by Automattic in June 2025 and rebranded to Mesh in 2026 — in this category that is not a thought experiment.
Common questions
- Can you read my notes?
- The local core is planned for v1. End-to-end encryption belongs to the proposed own-storage sync design. There is no publicly approved security evidence for a running sync service; support for a storage provider alone does not verify that property. Content in a support request can reach us.
- Is the local database encrypted?
- The vendored app measurement does not confirm an encrypted local database. It records an unencrypted SQLite file; an app lock does not encrypt that file. Protect your device and backups independently.
- Is my data in the EU?
- Local data lives on your device. End-to-end encrypted sync over storage you run yourself — a local or shared folder, or a WebDAV server — is planned for v1. Google Drive as a destination is not decided yet. Managed sync on Endearist Cloud is planned for after v1, as part of the Pro Cloud subscription only. Location and operation of a future managed service are not a confirmed guarantee today.
- Has Endearist been audited or certified?
- There is no documented external security audit or SOC 2 certification. Automated tests and an app preview do not replace that review.
- Which third parties are involved?
- In the browser, the Tally form on the requests pages. Analytics and fonts are self-hosted; the newsletter provider is contacted server-side. The complete list is in docs/csp-allowlist.md.
- How do I get my data out?
- Markdown, CSV and vCard export: not publicly available yet. Status: planned for v1. The documented implementation has a separate readable ZIP export with media and a report of omissions; legacy exports remain partial. This is not device or release acceptance. Future access to reading, export, backup and restore must not depend on a subscription.