Privacy, the way it
should have been.

Last updated: July 18, 2026

Our approach

Ampersand is a native macOS application that stores your documents on your own device. We designed it so that the private thing — your writing — stays with you. The app does not require an account, and using it does not create a profile of you on any server we operate.

What we do not collect

• Your notes. The content of your documents never leaves your machine unless you choose to send it somewhere (for example, to a cloud AI provider you configured, or by exporting a file). We never receive a copy.
• Accounts. There is no sign-up and no login. We do not store your name, email, or password, because we never ask for them to use the editor. (The one place we hold an email address is if you publish a note and restrict it to specific people — those are addresses you supply, described below.)
• Behavioral tracking. There is no analytics SDK following you around the app, no advertising identifiers, and no record of what you write, open, or click. The one exception is a single anonymous count, described just below.

The one thing we count

Ampersand is free and needs no account, so an anonymous count is the only way we can tell how many people actually use it. Once a day, the app sends a small ping containing a random identifier (generated on your Mac, tied to nothing about you), the app version, your operating system and language, whether you're on the free or Pro tier, and a plain number of how many notes are in your vault. Your approximate country is derived from the connection and the IP address is discarded, never stored.

That is the whole payload. It never includes your notes, their titles or filenames, your file paths, your API keys, or your passphrase — and it is not linked to any profile, because there is no account to link it to. You can turn it off at any time in Settings → General → Privacy, and it stops immediately.

Where your files live

Your library is a folder you choose — on your Mac, in iCloud Drive, or in any synced folder you already use. Ampersand reads and writes plain markdown there. If you use iCloud or another sync service, that folder is governed by that provider's privacy terms, not ours; we simply read and write files in the location you selected.

AI features are bring-your-own-key

AI is optional and off until you set it up. When you connect a cloud provider (such as Claude or OpenAI), you supply your own API key, and requests go directly from your Mac to that provider using your key. Only the specific text you act on — the selection, document, or question — is sent, and only when you invoke a feature. Those requests are subject to the provider's privacy and data-retention policies.

If you prefer that nothing leaves your device at all, use Apple Intelligence or a local model through Ollama. In that case, even the AI runs entirely on your Mac. When a document is encrypted, cloud AI actions are gated behind an explicit confirmation.

Encryption

You can lock individual notes so their contents are encrypted on disk (age: X25519 + ChaCha20-Poly1305) under a single passphrase per vault, unlockable with Touch ID. The passphrase and the keys derived from it never leave your device and are never sent to us.

Publishing a note to the web

Publishing is optional and off unless you use it. When you publish a note, only that single note is uploaded — as a self-contained page — to our hosting at ampersand.page; nothing else in your vault leaves your machine. The page gets a long, random, unguessable link and is kept out of search engines — always, not as a default you could switch off. As with any web request, that link's random identifier may appear in standard hosting access logs used to operate and protect the service; we don't log the note's contents. You can unpublish at any time, which removes the page. See the acceptable use policy for the rules on published content.

A published note is stored on our server as a readable page. Restricting who can open it is access control, not end-to-end encryption: unlike a locked note in your vault, we hold the contents in a form we could read. Publish accordingly.

Restricting who can read a published note

You can put a published note behind a password, or behind a list of people. Both are optional, and neither changes anything about notes you keep on your Mac.

• A password is chosen in the app and stored in your vault. We store only a slow one-way hash of it on our server, never the password itself — though, as with any login form, the password does pass through our server when you set it and each time a reader enters it. How you get it to your readers is up to you and we never see that.
• A list of people means you give us the email addresses (or a company domain) allowed to open that note. This is the one situation where we store an email address you have given us. When someone on the list opens the link, we email them a six-digit code so they can prove they control that mailbox.

Those addresses are used for exactly that and nothing else: no mailing list, no product email, no sharing or selling, ever. They are stored for as long as the note stays restricted, and are deleted when you unpublish the note, switch it back to a password or a plain link, or when the link expires. Codes are short-lived, single-use, and stored only as a digest. To deliver them we pass the address to our email provider, Resend, which processes it on our behalf.

Once a reader enters a valid code their browser holds a cookie for that one note. It contains no address — only a hash — and it is the sole cookie this service ever sets. We do not build reader profiles, and we do not report back to you who opened a note or when. Removing someone from the list revokes their access immediately.

Payments

The editor is free. If you choose to buy Ampersand Pro, checkout is handled by our payments provider, Polar. We receive confirmation that a license is valid and the email associated with it, so we can validate your license; we do not receive or store your card details. License validation contacts Polar to confirm status and is cached locally so the app works offline.

The website

This marketing site is served as static files. It sets no tracking cookies. If that ever changes, we will update this page first.

Your control

Because your data is just files in a folder you own, you are always in control: move them, back them up, or delete them at any time, with or without the app. Uninstalling Ampersand leaves your .md files exactly where they are.

Changes to this policy

If we make material changes, we will revise the date at the top of this page. Because we hold so little, changes are more likely to be clarifications than expansions.

Contact

Questions about privacy? Reach us from the contact page. See also our security overview and terms.