Security & privacy

Private by architecture, not by policy

sitrep is an AI project status dashboard that reads the markdown on your disk - which means it deserves more scrutiny than most apps, not less. This page states what it does with your files, what any future server could and could not see, and how you can verify each claim instead of taking our word for it.

What we hold today: nothing

sitrep is a local-first desktop app. There is no account, no server component, and no telemetry by default. Your files are indexed into a local database on your machine and never leave it. The complete list of data we hold about you is: nothing.

That stays true after launch. The only network traffic the shipped app will produce is a static update-manifest check - and sync, if you explicitly enable it, under the design below.

The principles

The sync design

Sync - a read-only, encrypted mirror of parsed state and docs on a phone or second machine - is not built yet. The design is decided and published now, before any backend exists, so it can be judged before you are asked to trust it.

  • One symmetric account key, generated on your first device and never sent to the server. All content is encrypted on your device (XChaCha20-Poly1305 via libsodium) before anything is uploaded; the server stores ciphertext.
  • New devices pair over a QR / short code: the existing device approves and hands over the wrapped key directly. No passphrase ceremony required at onboarding.
  • Optional hardening for the security-conscious: a user passphrase (Argon2id-wrapped key) and a printable recovery key - offered once, skippable, with a plain warning that we cannot reset it.
  • Metadata is minimized, not just content: blob names are HMAC-keyed ids and the sync manifest itself is encrypted, so the server cannot infer your project structure from the shapes it stores.
  • A read-only share link encrypts the shared subset with a per-link key that travels in the URL fragment - which never reaches the server. Revoking the link deletes the blobs.

What the server can see

  • The email address on the sync account
  • How many devices are paired
  • Encrypted blob sizes and timestamps

What the server cannot see

  • File names
  • File contents
  • Extracted state - statuses, decisions, due dates
  • Project names or structure

When sync ships, this page will restate that list against the actual implementation. If the two ever disagree, the page is wrong or the product is - either one is treated as a bug.

Trial and licensing, offline

sitrep will be a paid desktop app, and paid apps usually mean phone-home license servers. The licensing is designed so that it never conflicts with the local-first promise - like sync, this is the design the app will ship with, stated before launch so it can be held against us.

  • The trial is the full app, locally: no account, no sign-up, no network required to start reading your own files.
  • A license key is a cryptographically signed file (ed25519), verified on your machine. The app can check that your license is valid with the network cable unplugged - forever.
  • Activation pings are optional and fail open, with a long offline grace period. The app never bricks because our server is down, your network is down, or we have a bad week.
  • Local features never check entitlements at all. Only sync - the part that uses our infrastructure - carries a subscription entitlement, and cancelling it stops sync and nothing else.
  • Payment runs through a merchant of record: we never see or store your card details.

This one you will be able to verify the same way as the rest: activate a license, then cut the network. Nothing degrades.

How to verify, instead of trusting

"Private" and "encrypted" are claims every product makes. These are the paths by which sitrep's can be checked.

Cut the network
Run sitrep with Wi-Fi off, or deny it network access outright with an outbound firewall like Little Snitch or LuLu. Everything works: indexing, extraction, the overview, search, the reader. An app that is fully functional offline has no covert channel to lose your data through.
Read the traffic
The shipped app's outbound connections are few enough to enumerate: a static update-manifest fetch, and sync endpoints if you enabled sync. Watch them with any proxy or firewall; anything else appearing is a bug we want reported.
Read the protocol
The sync protocol will be public from day one - what is encrypted with what, what the server stores, what pairing exchanges. The "we cannot read your data" claim should be checkable against a document, not against our sincerity.
Bring your own storage
The sync client will speak the same protocol to any S3-compatible endpoint, including one you run yourself - and you can inspect the ciphertext it writes there. A hosted service is honest when leaving it is easy.
Independent audit
A third-party audit of the sync client is planned once the sync layer has the revenue to justify one. Until then, the published protocol and BYO-storage path exist precisely so you do not have to wait for our auditors.

This website

Noticed there is no cookie banner? That is not an oversight, and it is not non-compliance. Consent banners exist to ask permission for tracking; sitrep.md sets no cookies and tracks no individuals, so there is nothing to ask your consent for. The page you are reading is static HTML.

The only measurement on this site is Cloudflare's cookieless, aggregate Web Analytics - there to learn whether search engines and AI assistants actually send people here. It counts page views and referrers in aggregate: no cookies, no fingerprinting, no cross-site anything, no individual profiles, and still no banner, because there is still nothing to consent to. The one script it uses is added at the edge by Cloudflare, which already serves every page you see. If measurement here ever grows beyond that, this page changes first.