Privacy

Plain words, because this is a product about trust.

What we store

Your email address, and a salted password verifier (never your password itself).
Your notes, letters, voice recordings and photos — encrypted on your device before upload (AES-256-GCM). We store ciphertext. We cannot read it, and neither can anyone who steals our servers.
The delivery date of a sealed letter and the name you chose for its reader to see (like “Mom”) — a postmark and a return address, like an envelope. We can't see what's inside.
Your guardians' names, relationship types, and email addresses — kept in plain text, because those addresses are how we reach them (see the list below for exactly why).
If a guardian accepts, the name and address they typed for themselves, and the date they said yes (or stepped away).
If you use transcription: a monthly count of minutes (10 free on the free plan, unlimited on Guard) — a number, never a word of what was said.

What we cannot see

Your notes, letters, recordings, photos. We don't hold the keys.
Your location. We never ask for it, never store it, never send it.
Whether you are "okay". See What this product is not below.

AI is off unless you turn it on

No AI reads your content by default. When you do turn it on, only the notes you allow are processed — and any note marked 🔒 Keep from AI is excluded, permanently. "Off" means off: we cannot decrypt what we do not hold keys for.

Voice transcription — the one place audio briefly leaves encryption

Everything else in Never Far is encrypted before it leaves your device. Transcription is the deliberate exception, and it only happens when you tap Transcribe on a recording:

Your device decrypts that one recording and sends it over an encrypted connection, together with the text, to our transcription provider (OpenAI).
The audio passes through our server in memory only — we never write it to disk, never log it, and never store a copy. The transcript that comes back is encrypted on your device before it is saved.
We keep one number per month: how many minutes you transcribed (10 free on the free plan, unlimited on Guard). No content, ever.
If you never tap Transcribe, your recordings stay sealed forever — you can still export and play them offline with your password.

A transcript is your own words read back to you. It can contain mistakes — treat it as a convenience, not a record. The original recording is always the source of truth.

Letters that arrive later

A sealed letter is meant to be read by someone else, on a day you chose. That someone usually has no account with us — so the letter travels as a link, and the link is the key:

The letter itself is encrypted twice: once for you (opens in your app with your password), once with a random delivery key that lives only in the link, after the “#”. We never receive that key — it cannot leak from us because we never had it.
What we can see about a letter: the opening date, and the one name you choose for the reader to see (like “Mom”). That name is the whole envelope's worth of plaintext. Everything inside is ciphertext.
Before the opening date we don't even hand over the encrypted copy. Opening the link early shows only “it opens on…” — because that is all we could show anyway.
Anyone holding the full link can open the letter on the day — that is how a key works. Treat the link like a house key: send it the way you'd send something precious. If an email app trims the tail off a long link, the key is lost; the recipient page will say so and ask for the full link.
Your reader can keep a copy with one tap — a plain text file decrypted on their device. A letter should outlive us, not depend on us.

Cards — stored unsealed, so they can arrive alone

Sending a card needs only two things from us: an address and a date. That part is nothing — a delivery timesheet. The hard part is the other end: when your mother opens the link, her browser has to fetch the words from somewhere, and she has no account and no key. The only somewhere we can offer is our own server. So the card waits here until she opens it — and because it waits here readable, we could read it.

Cards are stored in the clear. The recipient's address, your name, the occasion, and the words you wrote. No one here opens them, and nothing is scanned, sorted, or fed to anything — but "nobody looks" is a promise about our behaviour, not a guarantee about the maths. Anyone who broke into this server could read them too. So we say that plainly instead of hiding behind the word "encrypted".
That is the whole trade: a letter stays sealed but you send the link yourself; a card arrives on its own, but waits here unsealed. Two tools, two jobs, and you choose per message.
So: keep cards to greetings. Anything private — anything you would not put in an ordinary email — belongs in a letter, where not even we can read it.
You can cancel a card any time before its date. After it is sent, the recipient's copy is theirs.
"Every year" cards repeat the same words on the same date until you cancel them. You can see the next date in your app.

Sealed cards — the one kind we cannot read

If the person you are writing to has set up a key, you can send a sealed card. Then the last paragraph stops applying: we store ciphertext, and a key that is locked with their password or fingerprint. We hold neither half of what opens it.

It still arrives on its own. Sending only ever needed an address and a date; opening has never been our job. That is why a sealed card works even if the sender is no longer here.
There is no reset. Not by us, not by support, not by court order. If the recipient loses their fingerprint, their passphrase, and their recovery code, that card is gone. We would rather say this plainly than quietly keep a copy "just in case".
Their key is one per address, and it cannot be swapped. Changing it would orphan every card already sent to them, so we refuse the second claim outright.
What we still see: the recipient's address, the sender's name, the occasion, the two dates — and the fact that a card exists. Not one word of what is inside.
The first card of any relationship cannot be sealed — there is no key yet. It arrives as an ordinary card, and at the bottom of it they are offered a key. Everything after that can be sealed.

Handing it on — the package for your guardian

You can choose a handful of days and seal them for your guardian. They open on their own, long after you have stopped writing — and only for that one person.

You choose the days. Not everything, unless you tick everything. What our server keeps is the list of chosen days; when the moment comes it hands over that list and nothing else — a note you didn’t tick never leaves your account, whatever anyone asks us for.
Sealed to them, not to us. The package holds your master key, locked with their public key — the one their fingerprint or passphrase unlocks. We store ciphertext; we have nothing that opens it.
Not before the waiting period. The package opens only after your silence window and the 15-day verification period have both passed. Until then nobody — including them, including us — can read a word of it.
Cancellable until it is handed on. Change your mind and you take it back; nothing has left. Once it has been handed over it cannot be recalled, and we say so in the app rather than showing a button that lies.
If they never set up a key, we don’t pretend. We refuse to seal a package they could not open, and we tell you why, instead of quietly storing something useless.

What a guardian sees

Guardians never see your journal. If you go a few days without writing, a guardian receives a status update: the last thing you wrote, possibly days ago, with its date. That is the whole message. Not your location. Not your other notes. Not an alarm.

A guardian reads what a status update means before they agree — the invitation link explains it in plain words, and they can decline without any fuss, or step away later.

What we keep in plain text — and what we can't read

We would rather say this plainly than bury it. This is the whole list of what sits in our database readable:

Your email address and password check value (not your password itself), so you can sign in.
Your guardians' email addresses. You typed them so we could reach those people — that address is the feature. If a guardian types their own address when they accept, we keep that one instead.
Guardian names you gave, whether they accepted or stepped away, and the dates of those decisions.
Payment facts from our processor: plan, amount, order number, receipt link.
Timing: when you last wrote (a timestamp, not the text), and which notices we sent when.

And here is what we hold without being able to read it: every note, every photo, every recording, every letter, every transcript, and the status note your guardian would receive. Those are sealed with keys we do not have. That is why the export works offline and why our own support cannot recover your password — there is nothing on our side to recover it from.

About refreshing the page. Your password is stored nowhere — not on our servers, not on your device. The key it unlocks lives in this browser tab's session storage, so a refresh doesn't make you type it again. Close the tab or the browser and it is gone for good; a new tab, a new browser, or another device will ask for the password again. We never see that key, and we could not read it if we did.

The status note you leave for them

The last thing you write is also sealed, separately, as a status note. Its key is cut in two: we keep one half, your guardian's invitation link carries the other. Neither half opens it alone — not for us, not for anyone who steals one of them. It only opens when both meet, which happens only if you go quiet long enough for us to send it.

You decide which note it is. It's always the most recent thing you wrote that you haven't marked 🔒 — never a locked note, never a summary, never an older note dressed up as the newest. If everything you've written is locked, we say so instead of sending something you didn't choose.

The countdown is public and slow on purpose: after the quiet period you chose, we email you first. Three days later we email you one last time. Only fifteen days after that does the note go to the guardian who agreed to watch over you. Writing anything at all — one line — cancels all of it.

Your export is always yours

You can download everything you have written at any time, on every plan, in a standard encrypted archive that opens offline with your password. This is not a feature we can revoke — it is the promise the product is built on. If we ever shut down, you get 90 days' notice and export stays available until the last day.

If you forget your password

We cannot email you a new one. That is not laziness — it is the same fact as everything else on this page: we never had your key, so there is nothing to reset. An email link proves the mailbox is yours; it says nothing about the key.

A recovery code is the one way back. When you make one, your device wraps the same key with a second lock derived from that code, and gives us only the wrapped copy. Using it re-opens the same key, so every note stays readable — nothing is re-encrypted, nothing is lost.
What we hold: that wrapped copy, plus a verifier that proves "you knew the code" without letting us derive it. Neither opens anything on its own.
What we can't do: look at the code, regenerate it, or use it for you. If you lose the password and the code, the notes are gone — and so is our ability to help. That is the trade for a system where nobody can read your writing, including us.

Deleting everything

Settings → Delete my account. It asks for your password, because it cannot be undone, and then removes your records, photos, recordings, letters, cards, guardians and the account itself in one transaction — not a flag, not a hidden archive. You do not have to write to us and wait to be forgotten.

What stays: the payment receipt record (amount, date, email), which tax law requires us to keep, and daily backups until they roll off on their own. Neither contains anything you wrote.
What never gets deleted for you: a guardian's or a recipient's own key, because it belongs to them and may still open things from other people.
Download first. The app offers the export right above the delete button, and we mean it as advice rather than a formality.

What this product is not

Never Far is not a safety monitor, not an emergency service, and not a welfare check. A status update reflects the last thing you wrote — possibly days ago — never your current condition. We do not monitor your safety, we do not contact authorities, and we cannot know if you are alright right now. If someone is worried about you, they should call you. If they believe someone is in danger, they should call 911.

Cookies

One session cookie keeps you signed in. No advertising cookies, no third-party analytics, no tracking pixels.

Contact

Questions about this page: privacy@neverfarapp.com

Terms · Refunds · Back to Never Far