OPEN
No sign-up. Write first
No inbox, no form, no wall standing between you and the page. Open the website and the writing area is already waiting; the moment your first words land, they are saved on this device.
You never told us who you are, yet you were already done writing.
ENCRYPT
Words are locked on your device
Every entry is encrypted with your passphrase before it leaves the device. From then on, sync or backup only ever moves ciphertext: a string of characters nobody can read.
Assume the worst happens: the whole database is stolen. What the thief gets is a crate of characters nobody can read. Not a single readable entry. Opening them requires your passphrase, and your passphrase never left your device.
The key is born on this device. We have never seen it, and we could not use it.
BIND
A passphrase is the identity
When you want to carry your journal across devices, set a passphrase. No account, no email, no identity that can be subpoenaed. The server only knows that an account exists; that is all.
If you forget the passphrase, only the recovery kit given at that moment can bring it back. We will say this clearly before you decide.
SYNC
Encrypted backup, keep writing on a new device
Encrypted backup and multi-device sync for 100 entries (one a day, about three months), free forever, including restore and export. After that, new entries stay safely on your device; nothing disappears, and no reminder interrupts your writing.
Half a sentence on your phone in the morning, continued on your computer at night. What travels between devices is always just ciphertext. Entries can carry images (see the Photos row below). The server receives nothing but ciphertext.
Export is free forever: being able to leave is the premise of being able to arrive.
No AI
Your journal is structurally impossible for AI to analyse or train on; the server never receives text. Not a promise to refrain from looking: simply unable to see.
No account
No email to leak, no account to subpoena, no identity to socially engineer. The only proof that you are you is a passphrase that exists only in your head.
Never deleted
We can never touch the journal on your device. Backups on the server are cleared only in two cases: you ask us to erase them; or your annual pass has expired, the 90-day grace period has passed, and they exceed the free quota. To keep them, export first: export is always free.
Sharing
After binding an account, publish a single entry via a share link: the reader needs both the link and the share passphrase to decrypt locally in their browser; the server can read neither. What you share is a copy of that moment; later edits do not sync. Expiry is tiered by plan (free: 7 days by default; annual pass: up to 90 days), can be revoked anytime, and a reporting mechanism exists.
Photos
Up to 5 per entry on the free plan, 30 on the annual pass; scaled down on your phone with location data stripped, encrypted under the same key as your words.
Pure local
Don't want to upload anything? Pure local mode writes with zero uploads. The app shell is cached on your device and opens even offline. Whether to back up, and when to start syncing, is your call.
Open source
The client core (the encryption core) is open source at github.com/tacet-ink/journal-core (MIT), and the public verification page replays the decryption of encrypted backups.
What we know
We truly cannot see content, but we do know that an anonymous account exists, its entry count, and when it is active. The privacy policy states every item. These numbers don't link back to you.
What this journal is for
Private
Thoughts you never want summarized or trained on by any AI: words are encrypted on your device, and the server has never received plaintext.
Feelings
Mood notes and mental-health journals: content even the platform cannot see is the kind you can actually write.
Drafts
Creators' drafts: ideas still taking shape, kept from algorithms and competitors alike.
Field notes
Field notes and research logs: raw records where sources need protection.
Moving in
Old entries moving from another journaling app: full export is free forever. Markdown, JSON, or an encrypted archive, all yours to take.
Care
Symptom and care logs: share one entry with your doctor by link plus share passphrase; the server sees neither, and the link expires on its own.
Unsent
Words not sent yet: to your future self, to someone else. Write them down first, in a journal even the server cannot read.
If we disappear
Leave anytime
Export is free forever: Markdown, JSON, and an encrypted archive, yours to take. You can leave anytime, without asking us first.
No dependence
Pure local mode never touches a server. After binding an account, a complete copy always remains on the device, readable offline.
Keys in your hands
Encrypted backups are locked with your own passphrase in a public format: paste one into the public verification page and it decrypts offline. The archive formats tacet-enc-v1/v2 are fully public.
Our commitment
If the service ever has to shut down, there will be advance notice; we will publish a shutdown runbook and, where possible, open-source the server side: where the export window lives, how data is disposed of, and how to move your backups out.
Honest limit
A forgotten passphrase is beyond anyone's help: no customer-service reset exists, and the only key that comes back is the recovery kit (24 English words).
Free and paid
Free
Writing, unlimited local entries, 100 encrypted cloud backups, multi-device sync, image attachments, full export and the recovery kit, free forever.
Annual pass
USD 24/year, launch price USD 8, first 100 codes onlyBuy the annual pass at USD 8The launch price is applied already (about NT$240 after the discount); enter the code Founder only if you go through Polar yourself.Lifts the 100-entry backup limit; share expiry 7→90 days and count 20→100; images 5→30 per entry and storage 100 MB→2 GB. Export stays free forever.
The code is shown on the payment confirmation page, and the confirmation email carries the same one. After purchase, redeem the code in the app's Security settings (Annual pass) to activate it instantly. One payment per year, no auto-renewal, with a full refund within 14 days: Refund policy, Terms. Payments are handled by Polar as merchant of record; the price excludes local taxes, and the final amount is calculated and shown by Polar based on your location at checkout.
Costs
This price supports backup storage, sync servers, and the domain. There are no ads, and the annual pass is the only income.
Launch price
Founder codes
Common questions
Do I need to sign up?
No. There is no email, no sign-up form: open the page and write, and text is saved to your device first. Your passphrase is the only identity, and it is only needed when you want multi-device sync.
Can the server read my journal?
No. Entries are encrypted on your device before they leave it: the wrapping key is derived from your passphrase via Argon2id, resistant to brute-force attacks (64 MiB, 3 passes; earlier accounts use PBKDF2 with 600,000 iterations and upgrade on next login), and entries are encrypted with AES-GCM. Only ciphertext is ever uploaded, so AI analysis or model training is structurally impossible. It only knows that an anonymous account exists, its entry count, and when it was active; it cannot know who you are or what you wrote.
What does the free tier include?
Encrypted cloud backup for 100 entries, multi-device sync, full export (Markdown/JSON and an encrypted archive), and a recovery kit: all free. Local entries are unlimited and are never deleted by quota.
What if I forget my passphrase?
A forgotten passphrase is unrecoverable by design. There is no forgot-passphrase flow and no support reset. When you bind an account you receive a recovery kit (a new one can be issued in security settings); keep it safe.
Can I use a non-English passphrase?
Yes. Non-English passphrases are part of the design: strength checking recognizes CJK characters, and encryption handles UTF-8 end to end. On iPhone, password fields lock to the Latin keyboard: tap the eye icon to the right of the field to switch to visible text and type with your own keyboard; the app shows this hint too.
What happens if I switch devices or clear browser data?
Entries are saved on your device first, so you can write offline. Once bound, what has synced lives on the server as encrypted backups: on a new device, sign in again with your passphrase (or recovery kit) and it comes back. Clearing browser data erases what is on that device: synced content returns when you sign in again; unsynced content cannot be recovered. To keep another copy, export from Backup first.
How much does it cost?
Core features are free forever: writing, 100 encrypted backups, multi-device sync, and full export. The annual pass (USD 24/year) lifts the backup limit and widens the share and image quotas (the three differences are listed in the pricing section). One payment per year, no auto-renewal, full refund within 14 days; the annual pass is the only income, and there are no ads.
How do I buy an annual pass, and where is my code?
After completing payment in the pricing section of the introduction page, the code is shown on the payment confirmation page, and the confirmation email carries the same one. If you miss it, open the Polar Customer Portal via "Access purchase" in the email to retrieve it; the redeem page walks through it step by step. Redeem in the app under Security settings, in the "Redeem annual pass" section: paste the code and the paid quota takes effect immediately.
What happens when the annual pass expires?
Your pass quota ends, and the next 90 days are a grace period: cloud backups become read-only but remain fully exportable, and renewing restores them. After the grace period, backups beyond the free quota (100 entries) are removed from the server; the journal on your device and backups within the free quota are unaffected. To keep everything, export within the grace period.
Can I share one entry with my doctor?
Yes. A single entry can be shared as a link, and it only opens when the reader has both the link and the share passphrase; the server sees neither. On the free plan shares expire in 7 days and can be revoked anytime; the annual pass extends this to 90 days. It fits showing a doctor what the period actually looked like, with nothing to remember to take back.
How do I add Tacet to my home screen?
Android (Chrome): "Add to home screen" in the menu installs directly; if the item is missing, use the browser share menu and choose "Install app" or "Add to Home screen". iPhone (Safari): use the share menu and choose "Add to Home Screen". Once installed, the app opens and lets you write even offline.
What we can and cannot defend against
Defend
Database leaks, wiretapping, our own curiosity.
Cannot
Malware on your device, a weak passphrase, losing the passphrase and the recovery kit together.
In full
What we can and cannot defend against is written plainly on one page: the threat model.
Silence is part of the score
The days you did not write are not blank;
they are the rests in the music.
When this journal leaves you alone,
it is still waiting for you.