Security model

Your journal is encrypted before it leaves your browser.

Kept uses client-side envelope encryption so journal content is stored as ciphertext. The key used to decrypt your entries is kept in the unlocked browser session rather than being sent to Kept as plaintext.

Current cryptography

  • AES-256-GCM encrypts journal content and encrypted preferences.
  • Argon2id derives key-encryption material from the secret you provide.
  • A fresh random IV is generated for AES-GCM encryption operations.
  • Supabase stores encrypted journal payloads; Firebase handles account authentication.
Your writing → browser encryption → encrypted ciphertext → synced storage

What is protected

Encrypted journal data

Notes, daily journal content, habits, sleep and mood data are stored in encrypted journal payloads.

Encrypted preferences

Journal preferences and default habit settings use the same client-side encrypted data path.

Recovery is intentionally different from ordinary password reset

Kept gives you a recovery key when the encryption vault is created. Because the service does not hold the secret needed to read your journal, losing both your unlocking secret and recovery key can make encrypted entries unrecoverable.

Analytics do not include journal content

Kept uses Vercel Web Analytics and Speed Insights for aggregate traffic and performance measurement. It does not use advertising trackers or session replay, and journal text is not sent to those analytics tools.

Read the privacy policy