Private Mode would keep a subset of fields encrypted on your device, so only you can read them. It’s aimed at entries you mark private, family-only heirlooms, and the pane you keep for yourself.
Target: 2027Q2Status: design
If we can’t keep a promise yet, it gets written here first.
Scope
What Private Mode would cover, and what it wouldn't.
In scope
Entry bodies marked private-only
Voice memos marked private-only
Attachment body bytes (metadata stays server-readable)
Excluded by design
Public profile fields (visible by design)
Memorial page content (moderation requires server read)
Shared space content (group read requires server decrypt hints)
Trade-offs
Honest downsides.
Lose the key and you lose the data. Lose the key and you lose the data. Before any field is opted in, there has to be a paper recovery-key ceremony a grieving person can actually follow.
Search stops working on private fields server-side. We’d offer a client-side index instead. It would be slower.
Syncing between devices needs key material you hold. That's why the design assumes at least two devices.
Why not now?
End-to-end encryption done badly is worse than none. Moderation and legacy transfer land first. Otherwise Private Mode quietly breaks both.
The recovery-key ceremony needs real user research, with grief-counsellor input, before anybody’s only copy depends on it.
Key rotation across a 20-year archive isn’t a solved problem anywhere. We won’t ship until there’s an answer we’d defend out loud.
More honesty
Looking for more?
The Trust Centre indexes every honest document we publish, and the binding legal ones sit below it.