Privacy

Three doors closed by the architecture, not by a promise.

This journal touches the most intimate material there is. The only protection that holds is the kind you can’t revoke with a change of terms: what doesn’t exist can’t be demanded, sold, breached, or subpoenaed.

No field identifies anyone else

No name, no nickname, no photo, no contact, no date of birth, no social link. One free-text label you choose, and nothing more. That’s what makes GDPR article 9 workable rather than theoretical.

No social layer about other people

No search by person, no matching between users, no reputation signal. Doxxing and defamation aren’t risks to moderate here: they’re features we didn’t build.

No plaintext on any server

Your journal only ever goes up encrypted, under a key we do not hold. We know an account exists and which address it answers to; we know nothing of what it holds. Zero-knowledge is structural, which is what lets us promise it without needing to be believed.

How, concretely

Amure is an installable web app that runs entirely on your device. No store, no tracking, and an account that only exists to recognise you: an address and a password, never the contents of your journal.

Encrypted end to end: Your journal lives online so you find it everywhere, and it is never readable there. What goes up is an encrypted block whose key derives from your password, on your device. Nobody but you can open it — not us, not our host, not anyone asking us.
One encrypted blob: The whole database is AES-GCM encrypted in a single file. Encrypting field by field would leave the structure readable — dates, durations, shapes. This way “nothing in plaintext” is true, not partial.
One password, two halves: Your password goes through Argon2id, then splits into two halves, neither of which yields the other. The first goes to the server and opens nothing; the second stays in your browser and unwraps your data key. Changing your password rewrites forty-eight bytes, not one line of your journal.
No language model: Nothing you write is sent to an AI, not to extract fields, not to rephrase. Every sentence shown comes from deterministic templates.
The export is yours: An encrypted archive, any time, free forever. You can also point Amure at a folder — if you sync that folder to your cloud, the copy leaves encrypted, without a single network call from us.