Notes are encrypted on your device before they sync. We store ciphertext. The one honest exception is Ask AI: text you choose to send is relayed through our server to Ollama Cloud and is not stored by us.
Cannot read: note titles, bodies, attachments, 2FA secrets in the vault, Secure Send contents (without the link fragment).
Can see (metadata): account email, item IDs, timestamps, ciphertext sizes, and similar sync metadata.
Full DevTools walkthrough: /verify
If notes have not finished syncing, Sign out warns you and offers Sync now or Sign out anyway, with clear copy that unsynced notes are not guaranteed on the server.
Share a note by link encrypted in the browser. The decryption key stays in the # part of the URL (browsers do not send that to servers). We store opaque ciphertext only. Recipients open within the view/expiry limits you set.
Details: /verify#verify-secure-send
Archives stay encrypted; you still need your vault password to open them.
Ask AI is optional. The text you choose to send leaves the vault in readable form, is relayed to Ollama Cloud, and is not stored by Deeperguard. Preview the payload in the app before you send.
Same-origin client assets are hashed in the browser and compared to the Sigstore-signed release on GitHub. Steps on /verify and Settings → About.
Email [email protected] with subject Vulnerability report.
