Privacy, the way it
should have been.

Last updated: September 12, 2026

Our approach

Ampersand has desktop, iPhone and iPad apps that store your documents on your own device. We designed it so that the private thing — your writing — stays with you. The app does not require an account, and using it does not create a profile of you on any server we operate.

What we do not collect

• Your notes. The content of your documents never leaves your machine unless you choose to send it somewhere (for example, to a cloud AI provider you configured, or by exporting or publishing a file). We receive only pages you choose to publish.
• Your microphone. Nothing is recorded unless you start a recording yourself, and the audio is transcribed on your own Mac. We never receive the audio, the transcript, or the summary — see recording a meeting below for the one part that can leave your machine, and how to keep even that on-device.
• Accounts. There is no sign-up and no login. We do not store your name, email, or password, because we never ask for them to use the editor. (The one place we hold an email address is if you publish a note and restrict it to specific people — those are addresses you supply, described below.)
• Behavioral tracking. There is no analytics SDK following you around the app, no advertising identifiers, and no record of what you write, open, or click. The one exception is a single anonymous count, described just below.

The one thing we count

Ampersand is free and needs no account, so an anonymous count is the only way we can tell how many people actually use it. Once a day, the desktop app sends a small ping containing a random identifier (generated on your computer, tied to nothing about you), the app version, your operating system and language, whether you're on the free or Pro tier, and a plain number of how many notes are in your vault. Your approximate country is derived from the connection and the IP address is discarded, never stored.

That is the whole payload. It never includes your notes, their titles or filenames, your file paths, your API keys, or your passphrase — and it is not linked to any profile, because there is no account to link it to. You can turn it off at any time in Settings → General → Privacy, and it stops immediately. The iPhone and iPad app has no telemetry ping or analytics SDK.

Where your files live

Your library is a folder you choose — on your computer, in iCloud Drive, or in any synced folder you already use. Ampersand reads and writes plain markdown there. If you use iCloud or another sync service, that folder is governed by that provider's privacy terms, not ours; we simply read and write files in the location you selected.

AI features are bring-your-own-key

AI is optional and off until you set it up. When you connect a cloud provider (such as Claude or OpenAI), you supply your own API key, and requests go directly from your computer to that provider using your key. Only the specific text you act on — the selection, document, or question — is sent, and only when you invoke a feature. Those requests are subject to the provider's privacy and data-retention policies.

If you prefer that nothing leaves your device at all, use Apple Intelligence or a local model through Ollama. In that case, even the AI runs entirely on your computer. When a document is encrypted, cloud AI actions are gated behind an explicit confirmation.

Recording a meeting

Ampersand can record a conversation and turn it into a note. It is off until you start it: nothing listens in the background, no bot joins your call, and macOS shows its own orange microphone indicator the whole time one is running. You choose between recording just your microphone, or a call — where the app also captures the other side's audio through the system, the way a screen recording does.

The speech is transcribed on your Mac. The audio is turned into text by a speech model that runs locally, downloaded once and kept on your machine. The audio itself is never uploaded to us or to anyone else, and it is stored outside your vault so it is not carried into iCloud or any folder you sync. On a Mac that can store a key for it, that stored audio is encrypted at rest with a key belonging to that machine alone. By default it is deleted as soon as the transcript exists; you can choose to keep it, and you can delete any recording yourself in Settings → Meetings.

The one part that can leave your Mac is the transcript. If you have pointed the summary at a cloud provider — the same bring-your-own-key setup described above — the transcript is sent there, with your key, to be summarized. That transcript contains what other people said, and they are not the ones who configured it, so Settings → Meetings names the provider in plain text whenever the one you have chosen is off-device. Choose Apple Intelligence or a local model through Ollama and nothing leaves the machine at any point. We never receive the audio, the transcript, or the summary in any configuration.

If you turn on screen capture for calls — a separate setting, off by default — the app also takes occasional still frames of the shared screen, reads the text on them on your device, and puts them in the note. Those images go into your vault like any other picture you add.

Whether you may record a conversation, and whether you have to tell the other people first, depends on where you and they are. Ampersand is a tool on your computer, like a voice recorder; you are the one operating it, and letting people know is up to you.

Encryption

You can lock individual notes so their contents are encrypted on disk (age: X25519 + ChaCha20-Poly1305) under a single passphrase per vault, unlockable with Touch ID. The passphrase and the keys derived from it never leave your device and are never sent to us.

Publishing a note to the web

Publishing is optional and off unless you use it. When you publish a note, only that single note is uploaded — as a self-contained page — to our hosting at ampersand.page; nothing else in your vault leaves your machine. The page gets a long, random, unguessable link and is kept out of search engines — always, not as a default you could switch off. As with any web request, that link's random identifier may appear in standard hosting access logs used to operate and protect the service; we don't log the note's contents. You can unpublish at any time, which removes the page. See the acceptable use policy for the rules on published content.

A published note is stored on our server as a readable page. Restricting who can open it is access control, not end-to-end encryption: unlike a locked note in your vault, we hold the contents in a form we could read. Publish accordingly.

Restricting who can read a published note

You can put a published note behind a password, or behind a list of people. Both are optional, and neither changes anything about notes you keep on your computer.

• A password is chosen in the app and stored in your vault. We store only a slow one-way hash of it on our server, never the password itself — though, as with any login form, the password does pass through our server when you set it and each time a reader enters it. How you get it to your readers is up to you and we never see that.
• A list of people means you give us the email addresses (or a company domain) allowed to open that note. This is the one situation where we store an email address you have given us. When someone on the list opens the link, we email them a six-digit code so they can prove they control that mailbox.

Those addresses are used for exactly that and nothing else: no mailing list, no product email, no sharing or selling, ever. They are stored for as long as the note stays restricted, and are deleted when you unpublish the note, switch it back to a password or a plain link, or when the link expires. Codes are short-lived, single-use, and stored only as a digest. To deliver them we pass the address to our email provider, Resend, which processes it on our behalf.

Once a reader enters a valid code their browser holds a cookie for that one note. It contains no address — only a hash — and it is the sole cookie this service ever sets. We do not build reader profiles, and we do not report back to you who opened a note or when. Removing someone from the list revokes their access immediately.

Payments and licenses

The editor is free. Website purchases of Ampersand Pro use our payments provider, Polar. We receive confirmation that a license is valid and the email associated with it, so we can validate your license; we do not receive or store your card details. License validation contacts Polar to confirm status and is cached locally so the app works offline.

Purchases inside the iOS app are handled by Apple. StoreKit verifies your purchase on your device. To provide a Mac license or authorize publishing, the app sends Apple's signed purchase proof to our licensing service on Cloudflare, which verifies it and checks its current status with Apple. Apple also sends signed refund and revocation notifications. We do not receive your Apple Account password or card details.

For an App Store purchase redeemed on Mac, we retain its transaction and original transaction identifiers, purchase environment, refund status, and hashed Mac device identifiers with their activation records. These records let us restore the same license, enforce the three-Mac limit, and prevent refunded purchases from being reused. We retain refund records for that purpose. Resetting Mac activations removes the device activation records. We do not store the signed purchase proof or raw Mac license key on our server. The iOS app caches your Mac key in Keychain outside device backups; the Mac keeps its activation locally. These licensing records are separate from the anonymous usage count and do not contain your notes.

The website

This marketing site is served as static files. It sets no tracking cookies. If that ever changes, we will update this page first.

Your control

Because your data is just files in a folder you own, you are always in control: move them, back them up, or delete them at any time, with or without the app. Uninstalling Ampersand leaves your .md files exactly where they are.

Changes to this policy

If we make material changes, we will revise the date at the top of this page. Because we hold so little, changes are more likely to be clarifications than expansions.

Contact

Questions about privacy? Reach us from the contact page. See also our security overview and terms.