Zero-access encryption by design
Your synced profile data is encrypted on your device before it ever reaches a server, so the server stores only encrypted blobs it can never read. Calendar app connections are a documented plaintext exception, scoped to your Calendar inbox and read-only subscriptions.
What this means for you
- Everything in a profile is encrypted on your device before it is stored or synced.
- The server cannot read your synced notes, tasks, or finance records. It stores encrypted data it cannot decrypt.
- Graspee cannot reset a lost profile password. Losing it means losing access to that profile, so keep it safe.
- Calendar app connections are the documented exception: they share limited event data with your calendar apps on purpose, so they are not zero-access.
Using Graspee on one device
A local profile lives only on your device, protected by its own password. No account is needed, nothing is uploaded, and the app works fully offline. Without sync or an export, losing the device means losing the data with it.
Turning on sync
Sync uses a cloud account you sign into with an email code. Your profile is encrypted on your device before upload, and every device that wants to read it needs the profile password. Signing in restores your synced profiles; the profile password is what unlocks them.
Connecting outside services
Outside connections are optional, and each one has a clear boundary:
- Bank connections (a Plus plan feature) keep your credentials inside your encrypted profile. Provider traffic passes through the server temporarily, and the server keeps only non-reversible fingerprints of connection identifiers.
- Calendar app connections share event data on purpose. Quick Add events stay readable on the server for up to 7 days while pending, and published read-only feeds are readable by anyone with the subscription URL until you revoke them. Treat those URLs like passwords.
- Card entry for the Plus plan happens on Stripe's hosted page. Your card details never enter Graspee.
What this does not protect
- Anyone who knows your profile password can unlock the profile.
- Zero-access protects what is stored and synced on the server. It does not protect a browser session that is already unlocked or a device that is already compromised.
- Exports are plaintext files. Once a copy leaves the app, protecting it is up to you.
Technical details
Profile encryption
Your password and a random salt run through PBKDF2 (a password-based key derivation function) with SHA-256 and 200,000 iterations to derive a key-encryption key. That key encrypts a randomly generated data key, and the data key encrypts every record with AES-GCM-256 before it is stored. Your password never leaves the browser.
Sync and sessions
Sync transports encrypted Yjs CRDT (conflict-free replicated data type) documents over WebSocket. The server stores opaque encrypted shards and relays them between your devices without decrypting them. After unlock, the data key is kept in sessionStorage re-encrypted under a temporary wrapper key: it survives a page refresh, clears when the browser closes, and is a convenience for an already-unlocked session rather than a second security boundary. Sessions use HttpOnly cookies, origin-checked requests, and rate-limited authentication.
Outside services
Financial data providers (Plaid, plus Flinks and MX where enabled) are relayed through the server without durable storage; ownership proofs and the link ledger use one-way HMAC (keyed hash) fingerprints, never raw identifiers. Calendar Bridge endpoints hold pending Quick Add events and published feed artifacts in plaintext as described above, and store credentials and feed tokens only as hashes. Stripe processes subscription payments on its hosted checkout; card details stay with Stripe, while Graspee keeps Stripe-issued identifiers plus limited checkout and audit records under the retention rules in the Privacy policy, and applies billing changes only after verifying signed Stripe notifications.
For what is collected and how long it is kept, read the privacy policy. For how to take a copy of your data with you, see the export answer in the FAQ.
Every profile you create works this way from the first unlock. Try it with sample data, or create your own.
No account required. Your profile data stays on this device unless you turn on sync.
