Privacy

The design commitments the formal policy will codify are already in the product:

• The app works entirely on your device. No account is ever required to communicate, and nothing about board use is sent anywhere.
• If you opt into sync, everything a profile contains — boards, settings, and (only with a separate per-person opt-in) voice recordings — is end-to-end encrypted on your device before it leaves it. The server holds ciphertext it cannot read or listen to.
• We do not sell data, show ads, run analytics on content, or use your data to train anything.

The full draft policy — including exactly what the sync server stores and what it can and cannot see — is public in the repository:docs/legal/privacy-policy.md. It takes effect, with counsel review, before accounts and sync are opened to the public.