The conversational version of our privacy posture. Same content, less formal.
No. First Light is end-to-end encrypted. Everything you write there is encrypted on your device before it's saved. Our servers only ever see ciphertext.
This is not a promise to look away — it's a technical inability. We do not have the key. Even if we wanted to read your First Light, we couldn't.
It depends on the Star.
Sealed Stars are encrypted, just like First Light. We can't read them. AI features don't work on them.
Open Stars are plain text on our servers. We can read them in principle — we promise not to, but the only thing stopping us is our promise. AI features work on them, because AI needs the plaintext.
You choose at the moment you promote a thought from First Light into a Star. Sealed is the default. You can change a Star later, but plaintext that's been on our servers has been on our servers — backups and logs may still hold it.
Because most thoughts don't need AI. The default should match the most common case, and the most common case is "I want to keep this, not necessarily have a model think about it."
You're not opted into AI by default for any specific Star. You opt in per Star, when you choose Open. The friction is intentional — it makes the choice conscious.
When you invoke the AI panel on an Open Star, the Star's content travels to Anthropic (for the panel actions) and OpenAI (for finding related Stars). Both companies state in their commercial API terms that they don't train models on data sent through their APIs.
We log that you used AI, for billing and rate-limiting. We don't log what you wrote.
If you don't want any of this, leave the Star Sealed. AI features won't be available, and your content won't go anywhere.
If you saved your recovery key when you signed up, use it to recover. You'll set a new passphrase and get back in.
If you lost both your passphrase and your recovery key: your Sealed content is gone. We cannot recover it. Not because we won't — because we can't. We don't have a copy of any key that could decrypt it.
This is by design. It's the only way we can honestly say "even we can't read your First Light."
We strongly recommend saving your recovery key in a password manager when you sign up.
Every Star and every First Light day has a copy markdown button. Sealed content is decrypted in your browser before it lands on the clipboard; Open content goes straight through. You can paste into any editor that handles Markdown — your words are never locked inside Endpaper.
Bulk export (the whole library, one zip) and account deletion are coming. Until then, the per-record copy buttons cover the same ground for any individual page you want out.
Anthropic's commercial API doesn't train models on data sent through it. They retain it briefly for abuse monitoring, then delete it. Their data handling policy is at anthropic.com/legal/commercial-terms.
We chose Anthropic in part because their default-off training stance matches what we want for users.
OpenAI provides embeddings — turning Open Stars into vectors that capture meaning so we can find related thoughts. Their commercial API also doesn't train on your data by default. Their policy is at openai.com/api-data-privacy.
Yes. All traffic between your device and our servers uses TLS. This is independent of Sealed vs Open — both kinds of content are encrypted in transit. Sealed content is additionally encrypted at rest in a way we can't decrypt.
Standard server logs (request paths, status codes, IPs) for operating the service.
For AI usage: which user invoked which action, token counts, costs. Not the content. Logs are kept 90 days then rotated.
We don't run analytics, A/B tests, behavioral tracking, or session recordings.
If we receive a valid subpoena, we'll produce what we have. For Open Stars, that's plaintext. For Sealed Stars and First Light, that's ciphertext we cannot decrypt. The cryptographic protection holds against court orders to us, because we don't have anything to hand over — only the user does.
If we're legally able to tell you about a subpoena affecting your account, we will.
A page that resets each morning, anchored to 4am in your timezone. You open Endpaper, and there it is — blank or with whatever you wrote earlier today.
It's the place to write before you've decided what you're writing about. The unguarded thinking. The half-formed thought.
It's also the most private surface in Endpaper. Always encrypted. Always.
Yes — but only in the direction of stronger protections, not weaker. We won't quietly walk back the Sealed-by-default posture. If we ever change the privacy policy in a way that affects existing users, we'll email you and explain it before it takes effect.
See also: the formal privacy page.