What is checkable

Claims are cheap. Here is each one with the thing that proves it, and a list of what is missing.

Last checked 9 September 2026

Two different things are described below, and mixing them up is the usual way a trust page ends up saying something untrue. Sections 1–5 are about the app. Section 6 is about this website, which is a separate piece of software with separate data. A sentence that is true of one is often false of the other.

1 · Encryption in the app

Note content is sealed with AES-GCM-256. Keys are derived with PBKDF2-SHA256 and held in the system Keychain, not in the database.

Check it: LatticeCore/Sources/LatticeCore/Crypto/LatticeCrypto.swift — AES.GCM.seal, deriveKey(passphrase:salt:).

2 · No analytics, no telemetry, no crash reporter

Not a reduced amount — none. There is no analytics SDK, no telemetry framework and no crash-reporting library anywhere in the app.

Check it: grep the Swift sources for Analytics, Firebase, Mixpanel, Sentry, telemetry. The result is empty, and an empty grep is a stronger statement than a paragraph.

3 · Sync is between your own devices

Sync runs on CloudKit, which means your iCloud account and Apple's infrastructure — not a server of mine. I hold no copy of your notes, because there is no server holding notes.

4 · The AI layer is the one exception, and it is off

If the AI features worked, a question you asked about your vault and the note excerpts needed to answer it would leave your device for a server. That is the only outbound flow of note content in the design.

Today it does not happen, because the backend runs nowhere public. That is a statement about the current state, not a guarantee about the future: when the AI layer is switched on, this section changes in the same commit.

5 · What the app does not have

  • No account. There is nothing to sign in to.
  • No advertising, and no third party who would pay for the data.
  • No App Store listing — so no purchase, no receipt, no subscription.
  • No independent security audit. Nobody but me has read this code.

6 · And this website, which is separate

Different software, different data. What happens here:

  • The waitlist form sends an email address, a consent version, a timestamp, a truncated user-agent string, and a salted SHA-256 hash of your IP address. Not the address itself — the hash is enough to show consent existed and cannot be reversed to an IP without the salt.
  • Nothing else is collected. No cookies are set, no analytics script loads, and there is no third-party origin in the Content-Security-Policy for one to load from.
  • The CSP is connect-src 'self' with no exceptions. You can verify it in the response headers of this page: the browser is not permitted to talk to any other origin.
  • The graph on the homepage is local. It draws twenty example notes shipped in the page source. It reads nothing of yours and sends nothing anywhere.

What is not here yet

  • A registered company, and therefore a data-processing agreement worth the name.
  • A published subprocessor list — there is one processor (the waitlist service) and it is named above.
  • Any external review of the encryption described in section 1.

The privacy notice is the formal version of section 6, and about lists the five things this site refuses to claim.