Help & Safety Guide

Your account

• No email is collected or required. Your password is your entire login - there is no username to remember.
• Your one-time recovery key is the only backup if you forget your password. If you lose both, your account and everything in it is permanently gone - we have no way to help you recover it, by design.
• Your case data is encrypted with a key derived from your password. We do not store your password, and we cannot read your notes.

The 45-day rule

If you do not log in at least once every 45 days, your account and all of your cases are permanently deleted, with no warning beforehand. This is deliberate: if you are ever unable to log in for any reason - including detention - your data does not remain on the server indefinitely waiting to be found. Log in periodically to keep your cases alive, especially before any extended period where you expect to be offline.

Keep identifying details out of your notes

Do not write your own name, a source's name, contact information, or other identifying details directly into a case. If you need to record something like that, keep it in a local encrypted volume on your own device instead - VeraCrypt is a solid, free, well-regarded option for that.

Working with a team

There is no case-sharing feature in this app, by design - a shared password or shared access would mean one compromised team member exposes everyone else, with no way to revoke just their access. Instead: each person on your team should register their own separate, independent account, and compare notes through whatever channel you already trust for sensitive coordination (in person, Signal, etc.) - the same way investigative teams have always done this, just outside the app.

Protecting yourself outside this app

• Use a VPN or Tor Browser. A VPN hides your IP; Tor Browser also resists fingerprinting, which a VPN alone does not do.
• Private/incognito browsing is not anonymity - it only avoids local history on your own device.
• Do not stay logged into your personal accounts (email, social media) in the same browser session you use for research.
• Think about the device itself, not just the browser, if your situation calls for it.
• VPN/Tor protection does not carry over between devices. If you upload a photo straight from your phone's camera over its normal cellular connection, your carrier has its own record of that phone reaching this site - separate from anything your laptop's VPN does, and often tied even more directly to your real identity through your phone account. Make sure whichever device you use to reach this site, phone included, has its own VPN or Tor active - or move the file to a computer that already does and upload from there instead.

What this app can and cannot protect against

This app protects the server side: no email or identity collected, encrypted notebooks, verifiable source archiving that never routes through your own IP. It cannot protect you from your own device being seized, from being coerced, or from what you choose to type into a note. Those are yours to manage - the guidance above is the best we can offer, not a guarantee.

← Back to your cases