A companion that listens to your life has to be private by architecture, not by promise. vera·you encrypts every word on your device before it ever touches a server. The keys are derived from your password — we don't hold them, can't request them, and can't help anyone else recover them.
Figure · 01 / The boundary
Your device
browserPassword
you type it
Master key
derived, in memory only
Private key
X25519, stays local
Session keys
AES-256-GCM
Transcripts · Audio · Memos
ciphertext ready for transit
Our servers
infrastructureenc(private_key)
opaque blob
key_envelopes
wrapped with your public key
enc(transcripts)
AES-GCM ciphertext
enc(audio)
hybrid-encrypted object store
enc(memos)
your reflections — as ciphertext
enc(pattern_evidence)
nothing human-readable
Never touch the server
01 — Zero-knowledge encryption
Your password is processed through scrypt to derive a master key — one that never leaves your device. That key unwraps an X25519 private key, which in turn unwraps per-session AES-256-GCM keys used to encrypt every recording and memo.
02 — Privacy by design
Most analysis runs on infrastructure we operate. A few steps use specialist AI providers, and every one of them is named here. In private mode, your audio stays on your phone and none of them receive anything.
03 — Infrastructure security
The processing pipeline is split into five independent workers — transcription, diarization, voice embedding, emotion, pattern detection — each running in its own container. Data travels between them as ciphertext, keyed by the session's envelope.
Figure · 02 / The ledger
Some metadata stays in plaintext so the product can function — search, dashboards, admin health. Everything below the boundary is encrypted with keys only you hold.
If it carries content or meaning, it's encrypted. If it's a count, a timestamp, or a category, it isn't.
What happens if you forget your password
"If both you and your recovery key are gone, so is your data. There is no master key we can hand over — because there isn't one."
Recovery key
A second key you write down
At setup, generate a 256-bit recovery key. Written on paper and stored offline, it's a second envelope for your private key — an escape hatch if you forget your password.
Password change
Re-wrap, don't re-encrypt
Changing your password re-derives the master key and re-wraps the private key. The underlying X25519 pair and session keys don't change — so your old sessions and memos stay readable.
No terms of service can make encrypted data readable. Yours isn't.