Help

Signing in

First sign-in is a magic link. Drop your email on /login, click the link we send, set a passphrase and save the recovery key the setup flow shows you once. From then on, your passphrase is what unlocks the encrypted parts of Endpaper.

Enroll a passkey from Settings and subsequent sign-ins skip the email round-trip — Touch ID, Face ID, or Windows Hello signs you in directly. Once a passkey is enrolled, click enable biometric unlock next to it and the daily unlock prompt becomes Tap to unlock. Browsers or password managers that don't support the WebAuthn PRF extension fall back to the passphrase form automatically.

If you ever lose your passphrase, the recovery key gets you back in from /recover. If you've used the recovery key somewhere you no longer trust, rotate it from Settings — the old key dies immediately. If you lose access to every passkey on every device, the lost-passkey recovery flow at /recover-passkeys issues a confirmation link that becomes valid after a 24-hour cooldown, then removes every passkey on the account and signs you in.

First Light

Each morning, Endpaper opens to First Light — a single page that's yours for the day. Days roll over at 4am local time, so writing past midnight still counts as today.

Write what's on your mind. The page is plain — no titles, no folders, no tagging. The point is to get the thinking out, not to file it.

When a line is worth keeping, select it and press ⌘↑ to promote it into a Star. The promoted text stays locked in First Light as a permanent record of where the thought came from; the new Star opens with the same text as its seed (immutable), ready for you to keep writing the riff (the editable body) around it.

When the day ends, First Light locks itself. You can come back to read past pages, but you can't rewrite them. The morning is the morning.

First Light is sealed by default. Every page you write there is end-to-end encrypted on your device before it reaches us. We hold ciphertext we cannot decrypt — not even if we wanted to.

If you lose your passphrase, we can't recover First Light for you. The encryption is the whole point.

Stars

Every thought you keep is a Star.

A Star gets a cosmic ID — like Endpaper-ε-39281. The Greek letter rotates by the month you created the Star (α for January, β for February, and so on through μ for December). The number is yours alone; nobody else's Stars share it.

Each Star has three parts: a seed (the original text from First Light, locked, displayed in italic), a body (the editable continuation — your riff on the seed), and tags (optional, no limit, lowercase). You can title a Star or not. The cosmic ID is the permanent address; the title is for you.

You can also create a Star without promoting from First Light: the home capture surface at / takes a single thought, with the ·🌙· sealed / ·○· open toggle to its right.

When you create or promote a Star, you choose how it's stored:

• Sealed — encrypted on your device. We can't read it. AI doesn't see it. This is the default for new Stars.
• Open — plaintext on our servers. AI features work on it. Searchable across your library by full-text and meaning.

The choice is per-Star. You can change it later — but be honest with yourself about what that means. Going from Open to Sealed only protects what you write after the change; what was already plaintext on our servers stayed plaintext while it was there. Going from Sealed to Open is a one-way decision: once we've seen plaintext, it has been on our servers.

Sealed Stars are searched on your device after you unlock. Open Stars are searched server-side, including by semantic meaning. Both modes work; they just feel slightly different. You'll know within a week which mode suits which kinds of writing. Soft-deleted Stars are restorable from Settings for 30 days.

Constellations and Galaxies

Tag a Star and it joins a Constellation — a pattern of Stars traveling together. A Constellation is just a tag with a name and a writable description. You don't create them explicitly; they appear when you start tagging.

Group your Constellations into Galaxies — life-areas like Work, Faith, Family, or whatever your life-areas actually are. Galaxies are the top-level grouping; everything else hangs off them.

Untagged Stars live in your Nebula — the unfiled inbox by another name. Most users have some Nebula activity; some users live there entirely. Both are fine. The product doesn't punish either pattern.

Endpaper doesn't have folders. You don't file things. You write, you tag what's worth connecting, and the rest sorts itself.

On any Star, click Stars sharing tags → to see other Stars that share at least one tag with this one, ranked by overlap count. Tags are plaintext metadata, so this works across storage modes — Sealed Stars appear here too. No AI involved; if you've built the connections yourself, this is the surface that shows them back to you.

Confluences

A Confluence is where the writing gets composed.

When the Stars in a Constellation start to gather around a piece of finished writing — a eulogy, a sermon, a seminar paper, an essay, a blog post — you open a Confluence inside that Constellation. The Confluence is a writable document with a cosmic ID of its own (Endpaper-Ψ-NNNN — the Ψ stays the same for every Confluence, because they're not month-anchored).

Inside a Confluence:

• The Stars sidebar (left, ⌘\ to toggle) shows the Stars in the current Constellation. Type to filter; ⌘1–⌘9 bring the Nth visible Star into the document at your cursor. A search all Stars → footer widens the source list to your whole library.
• The body is a Newsreader-typography editor with live markdown. Write fresh prose between brought-in Stars. Rearrange. Rewrite. The Stars themselves are unchanged in the Constellation; the Confluence is its own artifact.
• The sources panel (right, ⌘⇧S to toggle) shows where the text in your draft came from. Each Star that contributed appears as a card with its cosmic ID, range count, and percentage of draft. Hover a card → its ranges brighten in the body. The "original writing" footer shows how much of the draft is your own fresh prose.
• The outline (⌘⇧O) is a small popover listing your ## and ### headings with line numbers. Click any to jump.

A soft tint on the inline text marks ranges that came from a Star, plus a small dot in the left gutter. The marker is calm by design — visible if you look, ignorable if you don't.

Confluences have their own storage mode (Sealed or Open), independent of the Stars they draw from. A Sealed Confluence stays encrypted; an Open Confluence is plaintext on our servers. You pick at creation, with the same one-way honesty as Stars.

Find every Confluence at /confluences, or filtered by Constellation on the Constellation's page. Soft-deleted Confluences are restorable from Settings for 30 days.

Lenses

Some kinds of writing have their own shape. Endpaper has Lenses — opt-in toolsets that adapt the Confluence editor to specific kinds of writing.

Essay Lens is on by default. It gives every Confluence word count, reading time, an outline view for long documents, and clean defaults for PDF, DOCX, Markdown, and HTML export. Most writing fits Essay Lens. You probably won't think about it.

Speech Lens is for writing meant to be delivered aloud — sermons, talks, presentations, eulogies, keynotes. It adds:

• Delivery time in the chrome (replaces reading time). Default 130 words per minute. Adjustable in Settings.
• Performance markers. Inline [pause], [breath], [look up], and [emphasis]word[/emphasis] render in the editor as stage directions and are preserved in PDF export. They're stripped from Markdown and HTML export by default (the destination might not be the speaker); the strip can be turned off in Speech Lens settings.
• Presentation view at ⌘⇧F — full screen, Newsreader at 24pt (size adjustable), locked from editing. Space / arrows / PgUp/PgDn to navigate. Escape to exit.

Scripture Lens — turn it on when you're writing anything that quotes scripture, whether you plan to speak the piece aloud or not. References like Matthew 5:38 or 1 Cor 13:4-7 are recognized across the 66-book Protestant canon (plus common abbreviations) and rendered with a faint amber underline. Press Tab after a reference and the verse text inserts inline in quotes with a parenthesized citation. Public-domain translations (KJV, ASV, WEB) work out of the box via the free bible-api. NIV / ESV / NRSV / NASB will unlock with a future paid tier. Scripture and Speech are independent — turn on either, both, or neither.

Lenses are per-Confluence. You can have a Lens on for every new Confluence (set in Settings) or toggle it per-Confluence via the ·◐· lenses affordance in the chrome. The first pattern fits writers who publish in one form most of the time. The second pattern fits most other people.

Scholarship Lens is for writing with sources — coursework, papers, journalism, anything cited. It adds:

• A citation library at /citations. Each citation is a CSL-JSON record (the same shape Zotero and Mendeley use) — pick a type (book, journal article, chapter, webpage, newspaper, thesis, and more), fill in the fields, save. The library survives across Confluences.
• Attach a citation to a Star via ⌘⇧C on the Star detail page. The attached citation shows in the chrome as ▸ Author, Year. Reading-notes Stars carry their source.
• Insert citations into a Confluence via ⌘⇧C in the editor. Pick from the library or create one on the spot, optionally add a page or section locator, and the marker drops at the cursor. Bringing in a citation-bearing Star auto-inserts its citation at the end of the inserted prose.
• Four CSL styles ship at launch — APA 7, MLA 9, Chicago Author-Date, Chicago Notes & Bibliography. citeproc-js renders inline citations and the bibliography in your chosen style. Switching styles re-renders everything.
• Bibliography panel at ⌘⇧B. Right side of the editor, mutually exclusive with the sources and export panels. Lists every cited work, formatted in the current style, with a built-in style picker.
• Academic PDF — tick the box under PDF in the export panel. The document renders Times Roman 12pt, double-spaced, 1in margins, with a title page (department, course, professor, institution, date — pre-filled from Settings), and a hanging-indent bibliography on its own page at the end. For submission.

Scholarship Lens settings live in Settings alongside the other Lens preferences — you can set defaults for the title page so they're already filled in when you export.

Practice Lens (for therapists and others writing about sensitive client work) and Manuscript Lens (for long-form fiction) are spec'd but deferred. They're real ideas, not promised features.

Publishing

When a Confluence is ready to leave Endpaper, you publish it. ⌘E opens the publish panel from inside any Confluence.

Three destinations:

• Endpaper. A public page at endpaper.day/by/{handle}/{slug}. Newsreader typography, calm chrome, cosmic ID in the footer. Your archive at endpaper.day/by/{handle}/ lists every post you've published this way. RSS feed at endpaper.day/by/{handle}/feed.xml. OG cards auto-generated. No analytics, no cookies, no tracking on the public version. Set your handle in Settings → Publishing first (3–30 lowercase letters, numbers, and hyphens).
• Your own site, via Jekyll on GitHub. If you have a Jekyll site on GitHub (or any deploy pipeline triggered by a git push), connect that repo as a destination. Your Confluence is committed as a Markdown file with frontmatter to the path pattern you configure; your existing deploy takes over from there. The Confluence's body becomes a real post on your site, at your domain, with your existing typography. Configure in Settings → Destinations after installing the Endpaper Publishing GitHub App on the target repo.
• Download. A Markdown file with optional frontmatter, rendered entirely on your device and saved locally. Take it to Substack, Medium, a CMS without an API, anywhere. For Sealed Confluences this is the only destination where plaintext never crosses the wire.

Publishing a Sealed Confluence is a deliberate decision. A Sealed Confluence is encrypted on your device; publishing requires decrypting it. The decrypted body has to end up somewhere — on our servers for Endpaper, in your repo for Jekyll, on your device for Download. The publish dialog says exactly what's happening for each destination before you commit. Read the dialog. The trust contract is in the language of the warning.

Each published post on the Endpaper destination has two independent visibility toggles:

• Show on my archive page — when off, the post is hidden from /by/{handle}/ and from your RSS feed. The individual post URL still resolves. Use this for posts you want to share by link without listing publicly.
• Allow search engines to index — when off, the post gets noindex, nofollow meta tags and stays out of /sitemap.xml. RSS subscribers and archive viewers still see it. Use this for drafts or test posts you don't want surfaced by Google.

One Confluence can publish to multiple destinations at once. Each version carries the same cosmic ID; a reader who finds both versions can see they're the same record.

When the same Confluence lives at multiple URLs, the publish dialog offers a Canonical URL choice — which version should search engines treat as the original. Defaults to your own site when a Jekyll destination is in play, otherwise to whichever URL is already the primary. The Endpaper version gets a <link rel="canonical"> pointing at the chosen URL plus a small "originally published at..." footer; the Jekyll version gets a canonical_url: field in its frontmatter — themes that use the jekyll-seo-tag plugin (Minima and most others) honor that automatically. Custom themes need a small Liquid include; details in your destination setup.

Republishing updates the snapshot at that destination; the URL stays the same. Unpublishing takes the post offline. On Endpaper, the URL returns 410 Gone for 30 days (so bookmarked links degrade gracefully), then 404. On Jekyll, the committed file stays in your repo by default; the unpublish dialog offers a "delete from repo too" checkbox if that's what you want. Changing the slug at republish on Jekyll prompts a similar question about the orphaned old file.

AI

There's AI inside Endpaper, but it never speaks first.

Reach for it when you want a title for a Star, a connection between two ideas, or a fresh angle on something you've been circling. Seven surfaces have AI affordances; each one is dim until you invoke it.

• Title suggestion. On a Star, press ⌘⌥T in the body editor. Three candidate titles appear under the title field; click one to apply.
• Suggest tags. On a Star, click suggest tags → next to the tag input. Three to five lowercase candidate tags appear as chips; click any to apply. Existing tags in your library are passed in as context so reuse beats coinage.
• Find related. On a Star, click find related Stars →. Up to five cosine-nearest Stars from your library; click one to open it in a side panel beside the source.
• Tag both / suggest Constellation. Inside the side panel, type a shared tag or click suggest → for an AI proposal based on what the two Stars share. Tick also create a Constellation to land the tag and the Constellation in one move.
• Ask. A prompt against a single Star — "what's this missing," "what's the strongest line," "summarize this in three sentences." Returns a response inline; nothing is saved unless you copy it somewhere.
• Brainstorm. Same panel, "brainstorm" tab. Five angles you haven't taken on the thought. Optional steer to bias the directions.
• Synthesize. Same panel, "synthesize" tab. Auto-loads related Stars as a checkbox list; pick the set you want. Returns the through-line across them — not a Star-by-Star summary. A Synthesize this Constellation → button on the Constellation page does the same across the Open Stars in that Constellation.

AI works only on Open content. Sealed Stars and Sealed Confluences are never sent to any AI service. Open content travels over an encrypted connection to Anthropic (for the panel actions) and OpenAI (for embeddings — find-related, semantic search). Both providers state in their commercial-API terms that they don't train on data sent through their APIs.

You can turn AI off entirely in Settings. Endpaper is whole either way — the rest of the product doesn't need AI to work.

Search (⌘K) is hybrid by default. Open Stars match via server-side full-text + semantic (Reciprocal Rank Fusion). Sealed Stars and First Light pages are indexed in your browser after you unlock — they appear in the same palette alongside Open results, but the decryption stays local. Type a phrase, get matches by literal words and meaning across everything you've written.

Wrap a query in straight double quotes — "mom-mom", "the leverage of small bets" — to search for that literal phrase. Without the quotes, the words can appear anywhere; semantic matches are folded in too. With the quotes, only Stars and First Light pages containing the exact phrase come back, and the AI side sits out.

Keyboard shortcuts

Global

⌘K

open the search palette

⌘⌥N

jump to capture (the home page)

Esc

close any open overlay

First Light

⌘↑

promote selected text to a new Star

⌘S / ⌘↵

save

Editor (Star body, First Light, Confluence body)

⌘B / ⌘I / ⌘K

bold / italic / link

⌘⇧7 / ⌘⇧8 / ⌘⇧.

numbered list / bulleted list / blockquote

⌘.

focus mode (dim non-cursor paragraphs)

⌘\

typewriter mode (cursor stays vertically centered) — dormant inside Confluences, where ⌘\ opens the Stars sidebar

Star detail

⌘⌥T

suggest titles for the current Star (in the body editor)

Confluence editor

⌘\

toggle the Stars sidebar

⌘1–⌘9

(in the Stars sidebar) bring in the Nth visible Star

⌘⇧S

toggle the sources panel

⌘⇧O

outline popover

⌘E

open the publish / export panel

Speech Lens

⌘⇧F

large-print presentation view (24pt, locked editing; Space / arrows / PgUp/PgDn to navigate)

Tab

(after a recognized scripture reference, when recognition is on) insert the verse text inline

AI panel

No default

every reasonable Mod-letter combo is browser-claimed (⌘J = downloads, ⌘⌥J = DevTools, etc.). Set your own binding for the AI panel in Settings → Keyboard shortcuts — the page-level handler reads it at runtime.

You can override the global, First Light, and Star-detail bindings from Settings → Keyboard shortcuts. CodeMirror in-editor bindings (bold/italic/link, lists, focus mode, typewriter) stay hardcoded for now.

Settings, export, account

Settings has sections for your account (display name, handle, public bio), your passphrase (change it; you'll need the current one), your recovery key (rotate it), your passkeys (enroll, remove, or enable biometric unlock per credential), your Lenses and their preferences, your AI on/off toggle, your publishing destinations, your shortcut overrides, your daily word-count goal, your color mode (Light / Dark / System) and theme (Structured / Deep Space), and your export and account-deletion controls. The top of the page shows your lifetime First Light stats (words written, days written, current streak).

Every Star and every First Light day has a copy markdown button. Sealed content is decrypted in your browser before it lands on the clipboard — plaintext never goes through our servers.

Export. Download everything you've written as a single ZIP — your First Light pages, your Stars, and a colophon page. Sealed content is decrypted on your device before being added to the ZIP. The export never sees your plaintext on the server.

Account deletion. Permanently remove your account and all its content. Every foreign key cascades from users.id, so deletion is total. Type the confirmation phrase to gate the destructive button. After deletion, the keyring wipes from your device and your session ends.

In the works

The honest list of what's planned and what isn't built yet. Not promises — direction.

• Lyricist Lens — for writing song lyrics, with syllable counting, rhyme suggestions, and verse/chorus structure. Spec'd, not built.
• CodeMirror in-editor shortcut configurability — overrides exist for global and page-level shortcuts; the schema is in place to extend the same treatment to in-editor bindings (bold/italic/link, lists, focus, typewriter).
• Galaxy detail page — the backend search scope galaxy:<id> works; a /g/[id] page to surface it from is still to build.
• Practice Lens — confidentiality-first Lens for therapists and others writing about sensitive client work. Spec'd; deferred until the safeguards can be designed carefully.
• Manuscript Lens — outline view, named drafts, per-chapter word count for long-form fiction. Architecturally planned; not on a current timeline.
• Premium scripture translations — NIV, ESV, NRSV, NASB. Need paid API access; will land with a future paid tier.

Some of these will move faster than others. Some may not happen at all if usage tells me they're solving for the wrong problem. The product develops by what users actually do, not by what was planned six months ago.