Your data, your rules.

Local-first by default

The free-tier apps run entirely in your browser: your files, text and images are never uploaded, stored or seen by us. Server-assisted apps say so explicitly, process ephemerally, and delete automatically. We run no ads and no third-party trackers.

What we store with an account

• Account: your email and a salted scrypt hash of your password — never the password itself.
• Sessions: a random session-token hash and expiry, so you stay signed in.
• Billing: your plan, its period end, and Stripe customer/subscription references. Card details never touch our servers.
• Usage metering: per-app AI counters — numbers only, never content.
• Audit trail: sign-ins, plan changes and admin actions — no app content.

Billing & subscriptions

Plus and Pro are recurring 30-day subscriptions. At checkout, Stripe securely stores your card and automatically charges it each 30-day period until you cancel. Stripe emails you a receipt for every charge.

Cancellation: stops the next renewal. No refund is issued for the current period, and your plan stays fully active until the paid 30 days end. You can resume before the period ends if you change your mind.

Vault, notes & chat

Vault and notes are encrypted on your device before sync (PBKDF2 + AES-256-GCM). The server stores ciphertext only; we cannot read it. Losing your passphrase means losing access — by design. Secure Chat (arriving in Wave 3) will retain no message content: messages are deleted after delivery and vanish from devices 60 seconds after reading.

AI apps (Pro, Wave 3)

AI processing will use either on-device models or zero-retention API calls, clearly labelled per app. Your content is never used to train models. Each app has a published usage cap per 30-day period.

Your rights (PDPA / GDPR)

Request access to, correction of, or deletion of your account data anytime by emailing hello@digitalfutures.asia. Deleting your account removes your profile, sessions and billing references; encrypted vault ciphertext is destroyed with it. We are Singapore-based and process data in accordance with the PDPA; for EU users we apply GDPR-equivalent handling.