Privacy
The site and the app, in plain language.
Enclave is built so that your notes do not need a server, an account or a tracking layer. This page covers the website you are reading and the app you download.
This website
- No cookies, no analytics, no advertising and no third-party requests. The fonts, styles, scripts and images are served from this site.
- The only thing stored in your browser is your theme choice in
localStorageunderenclave-site-theme. It never leaves your device. - GitHub Pages hosts the site. GitHub may process standard request logs under its own privacy statement, which is outside this repository's control.
- The command palette, live demo, deep links and copy buttons run in the page. No demo input is sent to Enclave or to a third party.
The demos
The live tour and its editor, sync, whiteboard, graph and assistant views use sample data in the page. Ticked tasks, added lines, sticky notes and chat answers are not saved, not sent and disappear on reload. A view link is stored in the URL as ?view=…; copying one writes to your clipboard only when you press the copy command.
The app
The vault is a SQLCipher database on your device, unlocked by a password or a 12-word BIP39 phrase through Argon2id. Enclave has no account, no cloud, no telemetry and no crash reporting. Sync runs directly between your devices on the local network. The optional assistant sends page context only to the endpoint you configure; a local endpoint needs no internet.
The full security model, the trust boundaries and the private reporting channel are in SECURITY.md. The product overview is in the README.
Questions
Open a public issue for general questions, or report a vulnerability privately through GitHub's security advisory flow rather than a public issue.