1. Core Privacy Philosophy & Architectural Invariants
Sanctuary is designed from the ground up as a zero-knowledge private sanctuary. We believe that personal journaling requires radical trust, and true trust cannot depend on company promises alone. It must be guaranteed by mathematics, software architecture, and cryptography.
Our architectural invariants ensure that:
- Your raw voice audio never leaves your physical device.
- All stored reflections, audio files, and settings are encrypted at rest with client-side keys.
- We do not operate central user accounts, profiling databases, or surveillance trackers.
- Your data is never used to train foundation AI models.
2. 100% On-Device Speech Recognition (Zero Audio in Transit)
All speech-to-text processing executes entirely on your local device hardware using optimized Whisper models (via Apple Neural Engine on iOS, ARM NEON on Android, and Web Workers / WebGPU in modern web environments).
Binary audio blobs, buffers, and voice recordings are never sent over the network to our servers or any third-party speech API. Once recorded, audio is normalized into a standard 16-bit RIFF WAV format and encrypted before storage.
3. Zero-Knowledge Client-Side Vault (AES-256-GCM)
All application data is encrypted at rest using industry-standard AES-256-GCM authenticated encryption:
- Key Storage: Cryptographic master keys are generated on your device and stored in hardware-backed security enclaves (iOS Keychain via SecureStore, Android Keystore, or non-extractable CryptoKey in IndexedDB).
- Zero Server Access: We have no access to your encryption keys. Even if our servers or distribution channels were compromised, your journal entries and voice recordings remain completely indecipherable.
- Ephemeral Audio Decryption: Audio is decrypted into transient memory only when you press play, and is immediately destroyed when playback finishes or components unmount.
4. Three-Tier Artificial Intelligence Architecture
Sanctuary gives you complete autonomy over how artificial intelligence interacts with your reflections:
Tier 1: No AI (Audio & Transcripts Only)
Pure audio capture and local transcription. No summarization, structuring, or AI features are invoked. No text leaves your phone.
Tier 2: On-Device Intelligence
Lightweight open models running locally on your phone neural processor. All summaries and daily insights execute with no network connectivity.
Tier 3: External Intelligence with BYO Key or Secure Proxy
If you choose to use frontier models, only processed text notes (never voice audio) are transmitted over TLS. Your API keys are encrypted at rest on your device.
5. Website Data Practices & Early Access Waitlist
Our public marketing website operates under the same strict privacy ethics as our mobile application:
- Zero Tracking Cookies: We do not place tracking cookies, advertising identifiers, or cross-site fingerprinting scripts on your browser.
- Privacy-Preserving Experimentation: When testing different introductory headlines, variant allocation is stored temporarily in your browser session storage (tab-scoped) and discarded when you close your browser tab.
- Waitlist Submissions: If you submit your email for early access, we store only your email address and variant tag solely to notify you when the private beta is ready. We will never sell, rent, or trade your email address.
6. Data Portability, Ownership, and Complete Deletion
Your thoughts belong to you alone. You can export individual audio recordings and verbatim transcripts at any time. When you select Clear Vault in settings, all local databases, encrypted audio files, and cryptographic keys are permanently purged from your device storage.
7. Contact & Security Inquiries
If you have questions regarding this technical privacy policy, cryptographic verification, or security architecture, please contact us directly:
Formal legal representation and corporate address to be registered at: [CORPORATE ADDRESS / REGISTERED AGENT DETAILS].