A roadmap. Not a product. Target: 2027Q2.

Private Mode would keep a subset of fields encrypted on your device, so only you can read them. It’s aimed at entries you mark private, family-only heirlooms, and the pane you keep for yourself.

Target: 2027Q2Status: design

If we can’t keep a promise yet, it gets written here first.

Scope

What Private Mode would cover, and what it wouldn't.

In scope

Entry bodies marked private-only
Voice memos marked private-only
Attachment body bytes (metadata stays server-readable)

Excluded by design

Public profile fields (visible by design)
Memorial page content (moderation requires server read)
Shared space content (group read requires server decrypt hints)

Trade-offs

Honest downsides.

Lose the key and you lose the data. Before any field is opted in, there has to be a paper recovery-key ceremony a grieving person can actually follow.
Search stops working on private fields server-side. We’d offer a client-side index instead. It would be slower.
Syncing between devices needs key material you hold. That's why the design assumes at least two devices.

Why not now?

End-to-end encryption done badly is worse than none. Moderation and legacy transfer land first. Otherwise Private Mode quietly breaks both.
The recovery-key ceremony needs real user research, with grief-counsellor input, before anybody’s only copy depends on it.
Key rotation across a 20-year archive isn’t a solved problem anywhere. We won’t ship until there’s an answer we’d defend out loud.

More honesty

Looking for more?

The Trust Centre indexes every honest document we publish, and the binding legal ones sit below it.

Back to the Trust Centre

Model safety

Ask a human