Security & privacy

End-to-end, in your browser, before it ever reaches our servers: scripts, hooks, captions, notes, ideas and stickies, checklist items, retro notes (“why it worked”), AI-generated drafts, and your brand profile (description, audience, voice, facts).

Every field is encrypted separately with its own random key, bound to its exact record and field so a ciphertext can never be swapped between places without detection.

To run core features like calendars, digests, and team planning, certain functional metadata is kept readable on the server:

• Item titles, dates & statuses— so your calendar and digest can exist
• Series names— filters and AI prompts
• Platforms(Instagram/TikTok/YouTube) — board filters
• Member email addresses— sign-in and invites
• Metrics numbers(views, likes, comments, shares, saves) — insights math

None of this is your creative content itself — it’s the scaffolding the app needs to show you a calendar, send a digest, or count posts toward your weekly target.

Your encryption key is protected by a passkey, a passphrase, or a recovery code — whichever you set up. We never see the key itself, only an encrypted (“wrapped”) copy that only your unlock method can open.

For a solo brand, losing every unlock method means losing access to that content — we have no backdoor and cannot recover it for you. Save your recovery code somewhere safe. Brands with other members can still be unlocked by any member who has their own access.

Drafting and repurposing send only the text you explicitly submit to the model for that one request — your brief, brand profile, and any context you include. The model provider doesn’t store or train on it, and our servers never persist it; the request happens in memory, over an encrypted connection, for that request only.

File uploads are temporarily disabled while we build them to the same end-to-end encrypted standard as everything else. They’ll return once that’s ready.

We serve the JavaScript that runs the encryption in your browser. A compromised deploy could in theory serve code that undermines these guarantees — this is an inherent limitation of any web-based end-to-end encryption (the same caveat applies to Signal’s web client, WhatsApp Web, and every other browser-based E2EE product). We take deploy integrity seriously, but we want to be upfront about the boundary rather than overstate the guarantee.

Removing someone from a brand rotates its encryption key forward: a fresh key is generated and shared with everyone who remains, and the removed member’s access to it is revoked. This protects futurecontent — anything the removed member already decrypted while they had access was, by definition, visible to them, and rotation can’t undo that.