Variorum privacy

The short version

Your library is encrypted on disk, and sync is end-to-end encrypted. The Variorum server can never read your writing — in either mode. The only difference is who holds a key.

Your writing is encrypted. Your passphrase or your twelve words — together with any copy of your library — always open it. Everything else is a convenience.

• Variorum has no analytics. It doesn't collect or send anything about how you use it. It does check stargazing.tech for new versions; like any web request, that carries your IP address and your app's version, and nothing else.
• You can write in Variorum without an account. A Stargazing account is for sync.
• We can't read your writing, and we can't recover it for you. There is no reset, because a reset would be a key we hold.
• Export is always free. Your writing is never held hostage: if a sync subscription lapses, sync pauses and nothing else does.

On your Mac

• Your library is encrypted as one file, on every device, in both modes. It isn't optional and it isn't per note.
• Each library has its own random key, kept in a small key file beside it. Variorum keeps copies of the key file for you: beside the library, inside every backup, and a sealed copy in your Mac's keychain. The key file isn't secret. Holding it opens nothing without your passphrase, your twelve words or one of the conveniences below.
• Backups are encrypted too. A backup is the library plus its key file.
• A copy of your library carries no sync key and no device identity. Where a library names its devices, each one is a plain random ID made when the library was created. There's no hardware fingerprinting.
• Variorum never writes an unencrypted copy of your library on its own. Two plain copies exist, and both are yours to make: a Markdown export of your notes (File ▸ Export Library…), and an unencrypted copy of the whole library (Settings ▸ Data Safety), which goes only where you choose. A scheduled plain-text export is off unless you turn it on, and entering Castle turns it off, with a notice you can reverse.
• In Standard, anyone who can sign in to your Mac can open your library, through the Mac's keychain. That's the convenience Standard trades for.
• In Castle, the key isn't on your Mac in any form your login password can release. With "Always ask", no copy of the key stays on the Mac at all.
• Encryption on disk protects the files: a stolen laptop, a copied backup. While Variorum is open and unlocked, everything in it is readable — that is what open means. Locking is how you end that. In Castle, Variorum locks again when your Mac sleeps, when its screen locks, and after time away (you choose how long, or never).

What Apple holds

• In Standard, your Apple account holds a quiet key to the library on each Mac (an item in your iCloud Keychain, which also reaches your other Macs on that Apple account), and your Mac's login keychain holds one on the Mac itself. These are Apple's roads to your library, never ours. Apple holds a key to your library, never your writing.
• The keys your sync account shares between devices are locked by your passphrase and your twelve words, so a new device always types one of them to join.
• In Castle, nothing Variorum made opens through your Apple account. Entering Castle deletes the library's Apple and on-device keychain items, and the Apple deletion reaches every device on your Apple account. Two older locks are out of Variorum's reach, and neither one opens your current writing: a backup locked under an Apple account you've since left (Variorum can't delete another account's keychain item), and a key file someone kept outside Variorum's own folders, which still opens backups from before you entered Castle.

Sync and our server

Every text you write is encrypted on your device before it leaves (AES-256-GCM, a fresh nonce for every value). That includes the names you give things: notes, books, chapters, wings and shelves. The server stores only that ciphertext.

The server holds locked copies of your account's keys, never a key that opens them. It holds your account's main key, locked once by your passphrase and once by your twelve words; the sync keys, locked under that main key; and a count of how many earlier sync keys your account keeps. None of them opens without a secret you type.

What the server necessarily sees

• Your account's email address, and whether the account has sync.
• Content-free facts about what you sync: how many rows, their sizes, when and how often you write; ids, dates, positions and kinds. That includes the shape of your organization (how many books, wings and shelves you have, flags such as starred or finished, and their order), but never a name or a word in it. It also keeps a count of how much each account sends, as a guard against abuse; normal use never meets it.
• When each of your devices last synced. A device joining is visible; which file it came from isn't.
• Which mode your account is in, Standard or Castle.
• A per-account secret that lets the server check that a device holds your keys before it accepts that device's writes. It can't decrypt anything.
• The name your device gives itself when it last changed your account's keys, and when. So the server can see that your passphrase or twelve words changed, or that the account switched modes, on which named device and on which day. It never sees the secret or the keys.

What it doesn't see

• No content, no titles, no words. Not ever.
• Someone signed in to your account without your keys gets nothing from the sync copy: not its structure, not even a sequence number. They can fetch the locked copies of your keys and delete the whole account, and nothing else.
• Your account's sync activity is visible only within your account. Other customers can't observe it or work it out.

Your account password

Your account password signs you in and can delete your account. It never touches your keys.

Exactly what it can do: sign you in; sign you out everywhere; and delete your account, which removes the server's copy, your account's keys and the login while every copy on your devices stays. On an account that has never turned on sync, someone with the password could set up the account's keys before you do. That would be loud and survivable: your passphrase never opens what they made, and deleting the account is the remedy.

What it can never do: open a library, read or change what you've synced, change a passphrase or a mode, or export anything. Someone holding a stolen sign-in can't reach your writing. Account passwords need at least 12 characters, and passwords known from leaks are refused.

Deleting your account

Deleting your account deletes everything Variorum keeps for it on the server: your library's encrypted copy, your account's key record, its sync bookkeeping, and the login itself. Every library on your devices stays and still opens. You can set sync up again later under a new account.

Signing out, or stopping sync for a library, changes none of your library's keys or secrets. It stops syncing, and the server keeps what you sent. Deleting the account is how you remove it.

One thing deleting your account can't erase is the sign-in service's own log. Variorum's sign-in runs on Supabase, which records sign-in events: what happened, when, your account's email address, and the IP address. Those records sit in Supabase's own logs, kept under Supabase's retention rules rather than Variorum's.

Crash reports and feedback

Crash reports are off unless you turn them on in Settings ▸ Diagnostics. When they're on, reports stay on your Mac, and you can read each one exactly as it arrived. Nothing is ever sent on its own: Send Report… opens an email draft to support@stargazing.tech with the report attached, for you to read before you send it. To write to us about anything else, there's Help ▸ Send Feedback… or plain email.

If you connect an AI

Variorum's door for AI is a connection on your own Mac. It's closed until you open it, and it reaches nothing until you share something. Its permissions stay on that Mac and never sync. What an AI client then does with what it reads is up to that client and its provider, so share accordingly. Variorum and AI has the details.

Variorum hides what you haven't shared by making it not exist, as far as an AI can tell. It can't read an unshared note, search it, list it, or count it, and a private note looks exactly like a note that was never written. Hiding completely is impossible in only one kind of moment: when something hidden is in the way of what the AI asked to do. If it tries to add a note to a book that's already full of notes it can't see, the add can't quietly succeed — so Variorum says no, in as few words as possible: the book is full. Not what fills it, not how many, not what they're called. The AI learns that something is in the way, and nothing else.

Questions

The help page explains how all of this works: passphrases and the twelve words, Standard and Castle, backups and new Macs. For anything else, write to support@stargazing.tech.

Variorum · Help · Variorum and AI