Privacy
What this site holds, what it cannot see, and why the difference is built into it rather than promised.
Last updated 29 September 2026.
The short version
- Your documents never come here. They stay on your own machine. The console in your browser talks straight to your server.
- We cannot read your server's details. They are encrypted in your browser with a key we never receive. We store a blob we have no way to open.
- We hold your email address, and little else.
- No advertising, no analytics, no trackers, no third parties. Nothing on this site reports to anyone.
1. What we store
The whole of it, field by field. This is the actual database schema, not a summary of it.
| What | Why |
|---|---|
| Your email address | It is how you sign in, and the only way to reach you. |
| A hash of your login secret | Your browser turns your password into a login secret (PBKDF2-SHA256, 600,000 rounds) and sends only that. We hash it again, with a salt unique to you, and store the result. We never receive the password itself. See section 2. |
| A second, separate salt | Used in your browser to derive the key that encrypts your vault. Kept apart from the sign-in salt on purpose, so that proving who you are and opening your vault are different operations with different keys. |
| Your vault, encrypted | Your server's address, the API key it issued for this site, and your username and password on that server — sealed with AES-GCM before they leave your browser. See section 2. |
| When your account was created, and last used | So we can tell a dormant account from an active one. |
| Session tokens | Random strings that expire after 30 minutes without use (14 days at most). Only a hash of each is stored. They identify a signed-in session and nothing else. |
| Downloads of the program | Which file and when — a count, with no address or identity. |
| For each server you join: its name, its address, a hash of the code you joined with, your role, and when you joined | So the console knows where to connect and what to show you. A server's address is not a secret — knowing it gets you a login prompt and nothing more. |
That is everything. There is no profile, no usage history, no record of which documents you looked at, because none of that reaches us.
2. What we cannot see, and why
Before your server details — its address, its API key, and your username and password on it — leave your browser, they are encrypted with AES-GCM under a key derived from your account password using PBKDF2 with 600,000 rounds. That derivation happens on your device. The key is marked non-extractable, so not even the page that created it can read it back.
We never receive that key, and we never receive your password. Signing in sends a different value derived from the password with a different salt, and one cannot be turned into the other. This is deliberate: we hold the salt for your vault key, so if we ever received your password we could derive that key ourselves. We don't, so we can't. What we store is ciphertext. If someone stole our entire database they would have a list of email addresses and a pile of blobs nobody can open — including us.
The consequence is worth stating plainly: if you forget your account password, we cannot recover your vault. Not "we will not" — we cannot. You would set up your server details again, which takes a minute. A service that can recover your data on request is a service that can be compelled to hand it over, and we would rather be unable to.
3. What your browser keeps
We set no cookies. Nothing here follows you.
While you are signed in, the console keeps these in your browser's per-tab storage: your session token here, your vault salt, your account password, and the short-lived access and refresh tokens your own server issued when you typed your authenticator code. The password is held so the console can re-open your vault after a page reload without asking you again. It stays on your device, is never transmitted, and is discarded when you close the tab.
If you would rather it were not kept at all, sign out when you finish, or use a private window — closing it clears everything.
4. What we log
The web server keeps an ordinary access log (IP address, time, page) for up to 90 days, for security only. Failed sign-in attempts are recorded as a one-way hash of the address and email they came from, so that repeated guessing can be slowed down; those records are deleted within a day.
5. Third parties
The sign-in page and the console load nothing from anyone else: no analytics, no fonts, no content delivery network. That is enforced by the pages' Content-Security-Policy, because the password typed there is also the key to your sealed server details.
The two public pages — the home page and the download page — use Google Analytics to count visits. Nothing about your account or your server is ever sent to it.
Two exceptions exist elsewhere in AnaPlexus, and neither is part of this site:
- Anthropic. The desktop application sends your documents to Claude to work out what they are. That happens from your machine, under your own API key, and this site is not involved.
- PayPal. If you subscribe to the hosted service instead of using your own key, PayPal handles the payment. We never see your card details. That service is separate from this site and has its own terms.
6. Deleting your account
You can delete your account at any time from the console. When you do:
- your email address, password hash, salts and vault are deleted;
- your sessions end;
- any server you founded is removed from the registry, along with everyone's membership of it.
That last point matters: if you founded a server, deleting your account closes it here for everyone who joined. The server itself and its documents are untouched — they are on your machine, not ours — but the people you invited would need to be invited again.
Deletion is immediate and not recoverable.
7. Legal documents
People use AnaPlexus for court papers, medical bills and other material that would do real harm in the wrong hands. That is exactly why the design keeps it away from us: we cannot lose what we never held, and we cannot be made to produce it either.
If you are handling documents subject to a protective order, a confidentiality agreement or a professional duty, note that they never touch this site at all — they go from your scanner to your machine to Anthropic's API and back. Your obligations run to that path, not to this one.
8. Your rights
Depending on where you live you may have rights to see, correct, export or delete what we hold. Given that what we hold is an email address, some hashes and a blob we cannot decrypt, exercising them is short work. Write to us and we will do it.
9. Changes
If this policy changes in a way that affects what we collect or who sees it, we will say so on this page and date it. We will not quietly broaden it.
10. Contact
Write to privacy@anaplexus.com.
This document describes how the software actually behaves; the behaviour it describes can be checked in the source, which is the point of writing it this way. It has not been reviewed by a lawyer.