Journal

What zero-knowledge actually costs you

August 14, 2026

Every writing app that syncs says something reassuring about security. Most of them mean “encrypted in transit and at rest,” which is true and also approximately what your bank says. It means the company can read your work. It just promises not to.

We took the other road, and the other road has potholes. Here they are.

You can lose everything

Your password derives the key that unlocks your library. We never see the password and never see the key. If you forget the password and lose your recovery phrase, your documents are a pile of random bytes that nobody on earth can turn back into sentences. Not us, not a court order, not a very polite email.

This is the actual cost. Everything else on this page is an inconvenience; this one is permanent.

Server-side search is impossible

We cannot index what we cannot read. Search happens on your device, against your local copy. In practice this is faster than server search for any library smaller than a research institution, but it does mean a brand-new device has to finish pulling your archive down before it can search all of it.

No web-based document preview

Share links, email previews, “open in browser from the notification” — all of them require a server that can read the document. We do not have one.

What you get for it

A guarantee that survives us. If this company is acquired, breached, subpoenaed, or run into the ground by people with worse judgement than ours, the outcome for your unpublished novel is the same: nothing readable changes hands. That property does not depend on anyone’s promise, including ours, and it is the only kind of privacy commitment worth making.