Cornerstone · verify
We say we can never read your family’s data. A promise you can’t verify is just policy — so here’s how to confirm it yourself, without taking our word for anything. The whole thing rests on one fact: your data is sealed on your own devicebefore it ever leaves it. Check that, and everything else follows.
🔊 Hear this page — in my own voice
In the vault, seal a note, then tap “what the server sees.” You’ll see the exact bytes we store for that item — ciphertext and wrapped keys, no plaintext, no passphrase. That’s everything on our side. No technical skill needed; it’s a button.
Open your browser’s developer tools, go to the Network tab, and seal a note. Inspect the request that stores it: the body is the sealed envelope — ciphertext — and your passphrase and plaintext are nowhere in it. The sealing happens in your browser, before anything is sent. Our write endpoint even rejects a request that tries to hand it a key.
You don’t have to trust that our app is closed-source. The one part that carries the whole promise — the client-side sealing — is deliberately small and inspectable (standard AES-256-GCM + PBKDF2, the versioned SealedEnvelope v1 format). It ships to your browser in the open, so anyone can read exactly how your data is sealed and confirm nothing else is going on. That’s the honest-custody rule: the app can be closed, but the sealing is always something you can check.
Not a promise about our intentions — a map of the actual boundary.
| Who | What it sees | When | Can it read your vault? |
|---|---|---|---|
| HiveJournal (us) + our database | Ciphertext only, plus the label & kind you chose to make browsable | Whenever a vault item is stored or synced | No — it’s sealed with a key we don’t have |
| A frontier AI model (only on a hard ask) | Only the specific question you asked it in that moment — never your vault | Only when an AI ask is hard enough to escalate (on the box, most never do) | It sees that one prompt, nothing stored |
| A voice service (optional) | Only the text you explicitly choose to have read aloud | Only when you use a cloned or narrator voice | That text only |
| Off-site backup provider (optional) | Ciphertext only | When you keep an encrypted second copy off-site | No — sealed bytes |
| Everything else | Nothing | — | — |
The checks above are for the software tiers you can use today. The home box takes it further: pull the network cable and it still works (a device that runs offline can’t be sending your data anywhere), and a live panel shows every port it has open and every connection it makes — each one labeled in plain language, with history. When you asked nothing hard, you’ll see that nothing left. Verification you can watch, not a promise you have to trust — and a rule we hold ourselves to: every connection has to be nameable for a family, or it doesn’t get made.