Privacy is structural, not promised.

How the vault works

What we can and cannot see

• ✓

  We see: account email, authentication session, vault salt, Trace name and handle, learning goals, experience level, mission completion, confidence ratings, posts and messages you send, billing tier, and product analytics events.

• ✗

  We cannot see: vault file contents, competency baselines, practice drafts, or your derived encryption keys.

One caveat, stated plainly: today the master password also serves as the account password, so it transits to the authentication service over TLS at sign-in and is stored only as a salted hash, never in a readable form. Deriving a separate sign-in secret so the raw password never leaves your device is planned work, and the threat model tracks it.

The complete threat model, kept current with the code, is published in the source tree at docs/security/threat-model.md.

AI processing

When you opt in, Datum sends only the fields named in that tool's consent notice to a managed AI API. Datumly and the Practice mentor call Anthropic. Passwords, encryption keys, and unrelated vault files never leave your device.

Every AI turn shows a compact Receipt: what left the device, what stayed local, and that you decide before anything is saved as proof.

Three rules hold for every integration. It is opt-in, with the most protective setting as the default. It is receipt-shown, on every response. It is revocable: you can turn an integration off, export your data, and leave.

If AI is unavailable or you decline, built-in guidance and your saved local data stay usable, and Datum says when the answer was not an AI response. The full disclosure is on how we use AI.

Data residency & infrastructure

Supabase holds authentication, metadata, and community data, including reel titles and captions. The video files themselves sit in Netlify Blobs over TLS, and Netlify serves the site. Stripe handles billing: we store Stripe customer metadata and never handle or store payment card numbers.

Data export & deletion

• ✓

  Full account data export and account deletion are available from Account settings.

• ✓

  GDPR/CCPA-style access and deletion requests are also handled via hello@martori.studio.

Responsible disclosure

If you discover a security vulnerability, email hello@martori.studio with “Security” in the subject. We prioritize these and aim to acknowledge within 24 hours.