Privacy

What is stored

Your email address, your name and picture as Google reports them, and the date you joined. Those are how you sign in and how an administrator knows who has an account.

Everything else — every port number, project name, label, note, custom field and rule — is stored as ciphertext. It is sealed in your browser with AES-256-GCM under a key derived from a passphrase this server never receives and cannot derive.

What cannot be read, and by whom

Not by us, because we hold no key. Not by an administrator: there is no admin branch in any policy guarding your rows, and those tables keep force row level security, so even a database owner writing themselves a privileged function would read nothing. Not by anyone who obtained a database dump, because every readable field in it is ciphertext.

What this does not protect against

• A script running on this page. Client-side encryption protects against a compromised server and a leaked database, not a compromised page. That is why the content security policy is nonce-based with no inline scripts.
• Timing and volume. When rows were created and updated, and how many there are, are not encrypted. Someone with the database learns when you were busy and roughly how much you track.
• Losing your passphrase. There is no reset and no escrow. Lose both the passphrase and the recovery key and the ledger is gone. That is the trade.

Third parties

Google, to prove who you are — it never sees anything you store. Neon, which holds the ciphertext. Resend, only if invites are being emailed, and only the recipient’s address. There is no analytics, no tracking, and no third-party script of any kind; the content security policy would refuse one.

Deleting everything

Deleting your account removes the profile, the ledger and the wrapped key in the same transaction. Without that key the ciphertext was unreadable anyway, which is the point.