Architecture, not policy.
If I could read what you write, I'd be a liability the moment someone asked. So I made it impossible. The keys are on your device. The server holds locked boxes. I hold nothing I can read.
Vitni is a private AI chat with an encrypted journal attached. Every chat message and every journal entry is encrypted on your device with AES-256-GCM before any network call. That key is random, generated in your browser, and never leaves your device. Your passphrase runs through PBKDF2 at 310,000 iterations to derive a separate key that wraps it, and a 24-word recovery phrase wraps a second copy under its own salt. What the server holds is ciphertext, IVs, salts, and wrapped keys, and nothing that can open them. One exception, said plainly: the message you send the AI travels over TLS, and Anthropic has to read it in plaintext to answer. No name or email travels with it, Anthropic does not train on it, and it is deleted under a standard retention window of up to 30 days. The chat and journal pages load no analytics, no ad pixels, no tag managers. Lose both the passphrase and the recovery phrase and the writing is gone. There's no reset. That's what it costs to be the one holding the key.
How end-to-end encryption works here: one trip, and only you can open it.
Picture writing a letter, putting it in a locked box, and being the only person with a key. Your phone does the locking before the box leaves. The server holds the box. Nobody can open it but you.
- 01
On device
You type.
The words exist in memory on your laptop or phone while you edit. They never leave in plaintext.
- 02
In transit
It is encrypted before it leaves.
A key that lives only in your browser scrambles the text before it goes anywhere. Only the scrambled version travels over the wire.
- 03
At rest
The server stores a blob.
No key, no words. Reading the file yields noise. Nobody can open it, because the server never had the key.
- 01
On device
You ask a question.
The message is composed on your device and sent to the reflection endpoint over the network.
- 02
In transit
Encrypted in transit.
It travels encrypted to Vitni's server, which forwards it to the AI. The words are not logged on the way.
- 03
At the model
The model reads and replies.
The AI provider reads your message to answer, does not train on it, and deletes it on a standard schedule. No name is attached. Vitni keeps your side of the chat encrypted so you can come back to it.
Four guarantees. Verifiable, not promised.
Your phone does the locking.
Every entry is scrambled on your device before it leaves. The server only ever holds the scrambled version, never the words themselves. The exact method is in the appendix below.
I never see your passphrase.
Your passphrase unlocks the key, and it stays on your device. I never receive it. There's no master copy on my side, and no admin panel where I can peek.
Your words are not training data.
To reply, your message is read by the AI provider, with no name attached. They do not train on it, and delete it on their standard schedule. Vitni keeps your chat encrypted so you can return to it, and still cannot read it.
No trackers where you write.
The chat and journal pages don't load analytics, ad pixels, or tag managers. The marketing pages do, so I can see what's working. The pages where you write stay quiet.
If you lose your passphrase, your data is gone.
Signing in is one thing. The passphrase that unlocks your writing is another, and only you hold it. Lose both it and the recovery code, and the writing is gone. There's no reset that brings it back. Pick a passphrase you won't lose, and save the recovery code somewhere safe.
The technical details: cipher, keys, retention, and threat model.
If you're a security researcher, journalist, or engineer, this is the rest of the story. If not, the four cards above are the whole story.
- Cipher
- Journal entries and chat transcripts are encrypted with AES-256-GCM. Each payload has a unique 96-bit IV. GCM's authentication tag guards against tampering.
- Key derivation
- Your content is encrypted with a random 256-bit key generated in your browser, never derived from anything guessable. Your passphrase is run through PBKDF2 (310,000 iterations, SHA-256, 16-byte salt) to derive a separate key that wraps the content key. A second wrap comes from your 24-word recovery phrase, using an independent salt. Changing your passphrase re-wraps the content key without re-encrypting your data. The passphrase and recovery phrase never leave your device.
- What the server can read
- Vitni never sees your passphrase, your keys, or the words you write in the chat or the journal. Those are stored only as ciphertext with a per-item IV. Readable on our side: your email and the display name you enter (held by the login provider, Clerk), the settings you choose, timestamps, and how your sessions and entries are organised. What you write is not among them.
- Reflection requests
- Messages sent to the AI travel over TLS. To reply, the AI provider (Anthropic) has to read them in plaintext. Under Anthropic's commercial terms they do not train on API content, and they delete it under a standard retention window (up to 30 days) rather than keeping it indefinitely. Vitni does not have a zero-retention agreement in place today; if that changes, this line changes with it. The request is sent from Vitni's server, not your device, so your IP address, name, and email are never attached, and no stable per-user identifier is sent either.
- Retention
- Journal entries live, encrypted, until you delete them. Chat transcripts are stored encrypted too, so a past conversation is still there when you come back, not kept only on your device. Deleting your account removes your encrypted rows right away. Backups roll off on their own cycle.
- Crypto package
- The cryptographic primitives and the client-side encryption layer live in a separate @vitni/crypto package, kept narrow on purpose so it's small enough to reason about. The package isn't public yet; the full architecture is published at /privacy/deep-overview.
- Threat model
- The model assumes a compromised server, a subpoena, and a curious operator. It does not, and cannot, protect against a compromised client (keylogger, malicious extension) or a weak password. Pick a strong one.
- Subpoena posture
- If a government asks, the most I can hand over is what I can actually read: the ciphertext (useless without your keys), your email and display name, the settings you chose, timestamps, and the shape of your account. Not the words you wrote. A transparency report goes up the first time I receive a request.
The whole machine is written up at the deep overview: the key hierarchy, the threat model, the known limits, and how to check each claim yourself.
That's the architecture. Want to try it?
Sign up to be one of the first to try Vitni.