Testing phase · last updated August 2026
Your one-line prompt, your diary notes and any feedback you send are encrypted at rest. The decryption key is held separately from the database and is never stored in it. A leaked backup or a copied database file does not expose what you wrote.
Passwords are stored only as one-way hashes. Nobody can read one back, including us. Sign-in attempts are rate-limited. Sessions are revocable tokens in an HttpOnly cookie, and changing your password signs out every active session.
Structured facts, such as stations, dates, age and region, are what the map is calculated from, so they are stored in computable form. The rule is simple: what the map computes on stays structured; what only you were meant to write is sealed.
Our server holds the key because it does the work: turning your prompt into stations, rendering your diary, and sending reminders you asked for. Encryption at rest protects your words if the data ever travels without the server. It does not protect against a fully compromised running server. We state this plainly because it is true.
Two places, nowhere else. Your one-line prompt may be sent to our model provider for two narrow jobs: reading your line into a few plain fields (what you do, your level, your field, where you are headed) that we show back to you to confirm or correct, and choosing your starting station, and the station for a goal you named, only from candidates our own system produced. The model never invents a station, a number, or anything you see on the map; when nothing fits it says so rather than guessing; and this traffic is not used for training. Reminder emails go through our email provider. Your diary, maps and check-ins never leave our servers.
All traffic is encrypted in transit, behind a network layer that filters bot and scripted traffic before it reaches us.
Found a problem? [email protected]. Good-faith reports are welcome and will not be met with legal threats.