The conversational version of our privacy posture and the product. Same content, less formal.
No. First Light is end-to-end encrypted. Everything you write there is encrypted on your device before it's saved. Our servers only ever see ciphertext.
This is not a promise to look away — it's a technical inability. We do not have the key. Even if we wanted to read your First Light, we couldn't.
It depends on the Star.
Sealed Stars are encrypted, just like First Light. We can't read them. AI features don't work on them.
Open Stars are plain text on our servers. We can read them in principle — we promise not to, but the only thing stopping us is our promise. AI features work on them, because AI needs the plaintext.
You choose at the moment you promote a thought from First Light into a Star. Sealed is the default. You can change a Star later, but plaintext that's been on our servers has been on our servers — backups and logs may still hold it.
Because most thoughts don't need AI. The default should match the most common case, and the most common case is "I want to keep this, not necessarily have a model think about it."
You're not opted into AI by default for any specific Star. You opt in per Star, when you choose Open. The friction is intentional — it makes the choice conscious.
A writable document scoped to one Constellation, drawing on its Stars as raw material.
When the Stars in a Constellation start to gather around a piece of finished writing — an essay, a sermon, a eulogy, a seminar paper, a blog post — you open a Confluence inside that Constellation. The Stars sidebar lets you bring Stars into the document. You write the prose between them. The Stars themselves are unchanged in the Constellation; the Confluence is its own artifact.
Confluences have their own cosmic ID (Endpaper-Ψ-NNNN)
and their own storage mode (Sealed or Open), independent of the Stars
they draw from.
Opt-in toolsets that adapt the Confluence editor to a specific kind of writing.
Essay Lens is on by default — word count, reading
time, clean exports. Speech Lens is for writing
meant to be delivered aloud (sermons, talks, eulogies) — delivery
time, performance markers, a large-print presentation view. Scripture Lens recognizes references like Matthew 5:38 and inserts the verse text on Tab; turn
it on with or without Speech. Scholarship Lens is
for writing with sources — a citation library, inline citations in
your choice of CSL style (APA, MLA, Chicago Author-Date, Chicago
Notes), a bibliography panel, and an academic PDF export.
Practice Lens (for therapists writing about sensitive client work) and Manuscript Lens (for long-form fiction) are spec'd but deferred.
Lenses are per-Confluence. You can have one on by default for every new Confluence, or turn one on just for the piece you're working on.
When you invoke the AI panel on an Open Star, the Star's content travels to Anthropic (for the panel actions) and OpenAI (for finding related Stars). Both companies state in their commercial API terms that they don't train models on data sent through their APIs.
We log that you used AI, for billing and rate-limiting. We don't log what you wrote.
If you don't want any of this, leave the Star Sealed. AI features won't be available, and your content won't go anywhere.
When a Confluence is ready to leave Endpaper, you publish it. Three destinations:
Endpaper. Your Confluence becomes a public page at endpaper.day/by/{handle}/{slug} — Newsreader
typography, cosmic ID in the footer, your archive at /by/{handle}/, an RSS feed, auto-generated OG cards.
Hosted by us.
Your own site, via Jekyll on GitHub. If you have a Jekyll site on GitHub (or any deploy pipeline triggered by a git push), Endpaper can commit a Markdown post to your repo. Your existing site, your existing domain. Endpaper is the upstream writing tool.
Download. A Markdown file you take wherever you want — Substack, Medium, a CMS without an API, anywhere.
One Confluence can publish to multiple destinations at once. Each version carries the same cosmic ID, so anyone reading both can see they're the same record.
The publish dialog says exactly what's about to happen. Briefly: a Sealed Confluence is encrypted on your device, and publishing requires decrypting it. Where the decrypted version lives depends on the destination — on our servers for Endpaper, in your repo for Jekyll, on your device for Download.
If you want the published version to stay only on your device, use the Download destination. That's the only path that doesn't decrypt to our servers.
We show you a recovery key once, at signup. You save it somewhere safe — a password manager works fine. If you ever lose your passphrase, that recovery key is what you use to get back in: you'll set a new passphrase and recover access.
If you lose both your passphrase and your recovery key, your Sealed content is gone. We cannot recover it. Not because we won't — because we can't. We don't have a copy of any key that could decrypt it.
This is by design. It's the only way we can honestly say "even we can't read your First Light."
Save your recovery key when you sign up. Treat it the same way you'd treat the only key to a safety deposit box — because that's effectively what it is.
Yes — three ways.
Every Star and every First Light page has a copy markdown button. Sealed content is decrypted in your browser before it lands on the clipboard. Quick and useful for any individual page.
Bulk export lives in /settings — a single ZIP containing every Star and every First Light page. Sealed content is decrypted on your device before being added to the ZIP; the export endpoint never sees the plaintext.
And if you want to leave entirely, /settings has account deletion. It's immediate and irreversible — your data is removed from the active database the moment you confirm. Your words are never locked inside Endpaper.
Anthropic's commercial API doesn't train models on data sent through it. They retain it briefly for abuse monitoring, then delete it. Their data handling policy is at anthropic.com/legal/commercial-terms.
We chose Anthropic in part because their default-off training stance matches what we want for users.
OpenAI provides embeddings — turning Open Stars into vectors that capture meaning so we can find related thoughts. Their commercial API also doesn't train on your data by default. Their policy is at openai.com/api-data-privacy.
Yes. All traffic between your device and our servers uses TLS. This is independent of Sealed vs Open — both kinds of content are encrypted in transit. Sealed content is additionally encrypted at rest in a way we can't decrypt.
Standard server logs (request paths, status codes, IPs) for operating the service.
For AI usage: which user invoked which action, token counts, costs. Not the content. Logs are kept 90 days then rotated.
We don't run analytics, A/B tests, behavioral tracking, or session recordings.
If we receive a valid subpoena, we'll produce what we have. For Open Stars, that's plaintext. For Sealed Stars and First Light, that's ciphertext we cannot decrypt. The cryptographic protection holds against court orders to us, because we don't have anything to hand over — only the user does.
If we're legally able to tell you about a subpoena affecting your account, we will.
A page that resets each morning, anchored to 4am in your timezone. You open Endpaper, and there it is — blank or with whatever you wrote earlier today.
It's the place to write before you've decided what you're writing about. The unguarded thinking. The half-formed thought.
It's also the most private surface in Endpaper. Always encrypted. Always.
Yes — but only in the direction of stronger protections, not weaker. We won't quietly walk back the Sealed-by-default posture. If we ever change the privacy policy in a way that affects existing users, we'll email you and explain it before it takes effect.
See also: the formal privacy page. Or get on the list →
Anything else? Email [email protected] — Aaron reads every message.