The honest version.

We built field-level encryption for entry text and then refused to turn it on. Only one of the two write paths encrypts, and six read paths would hand you ciphertext where your own words should be: the sync pull, the entry page, the export, the digest email, the assistant's retrieval, the search index. Half an encrypted archive is worse than none. So the flag stops the app from starting. Until all of it is wired, your entries sit in the database as text our servers can read. That is the honest version.

Moderation, exports and legacy transfer all need server-side access, so our application can read these. We don't keep an audit log of administrative reads. Not yet. When there's one to describe, it'll be described here.

These are the fields we print on your public profile. They have to be plain text to the thing doing the printing. There's no way around that one.

We don't store passwords. There aren't any. A magic-link token is hashed before it reaches the database, then burned the moment it's used. The row left behind can't be replayed.

The card number never reaches our database. Neither does the CVC. Neither does the expiry. What we keep is a Stripe customer id and a subscription id, and that's the whole of it.

Backup schedules and retention live in the hosting provider's console. That's outside this codebase, and we won't describe it here from memory. One copy we can describe precisely. It's the one you take yourself: Settings, then Export, writes your entries, people, spaces, dates and the attachment bytes into a single file on your own device.