Built to keep
your words yours.
Ampersand is designed so the private thing — your writing — stays on your Mac. Here is a plain, technical look at how we protect it.
Local-first, no server
Your documents are plain .md files on your own disk. We run no server that holds your content, and there is no account to create.
Per-note encryption
Lock individual notes with age (X25519 + ChaCha20-Poly1305) under one passphrase per vault. Ciphertext on disk, plaintext only in memory when unlocked.
Touch ID unlock
Unlock encrypted notes with Touch ID via macOS LocalAuthentication. Your passphrase and keys never leave the device.
BYOK AI stays yours
Cloud AI uses your own key and sends only the text you act on, directly to the provider. Apple Intelligence and local models keep everything on-device.
Code-signed & notarized
The app is code-signed, notarized by Apple, and runs under the hardened runtime, so macOS can verify it before it launches.
Path & SSRF safeguards
File access is validated to your vault, and link-preview fetches run behind an SSRF guard that rejects private and loopback targets.
Last updated: July 2, 2026
Data storage and ownership
Everything you write is stored as plain markdown in a folder you choose — on your Mac, in iCloud Drive, or in any synced folder you already use. Ampersand reads and writes those files directly; there is no proprietary database and no server-side copy. You can move, back up, or delete your files at any time, with or without the app, and uninstalling Ampersand leaves your .md files exactly where they are.
Encryption at rest
You can lock individual notes so their contents are encrypted on disk using age (X25519 key agreement with ChaCha20-Poly1305 authenticated encryption) — no hand-rolled cryptography. Each vault has a single master passphrase that protects the note key. That key is stored only in a scrypt-wrapped key file, which is safe to sync but useless without your passphrase; a wrong passphrase simply fails the authentication check. Encrypted notes drop out of search, the link graph, tags, and version history while locked. Decrypting your own notes is always free — never gated behind a purchase.
Authentication
Encrypted notes are unlocked with Touch ID through macOS LocalAuthentication. The passphrase and any keys derived from it never leave your device. When you opt in, the passphrase is stored in the device-local Keychain, marked so it never iCloud-syncs — it stays on that one Mac. The scrypt-wrapped key file may sync so encrypted notes travel with you, but it cannot be opened without the passphrase.
AI and the network
AI is optional and off until you set it up. Cloud providers are bring-your-own-key: requests go directly from your Mac to the provider (such as Claude or OpenAI) using your own key, and only the specific text you act on — a selection, document, or question — is sent. If you prefer nothing to leave your device, use Apple Intelligence or a local model through Ollama, both of which run entirely on your Mac. When a document is encrypted, cloud AI actions are gated behind an explicit confirmation, so you never leave the encrypted boundary by accident.
Application integrity
The app is code-signed and notarized by Apple and runs under the macOS hardened runtime. That lets macOS verify the app hasn't been tampered with before it launches, and it keeps the binary within a constrained runtime environment.
Safe fetching and file access
When Ampersand fetches a link preview for a bookmark, the request runs server-side inside the app behind an SSRF guard that rejects targets resolving to loopback, private, or link-local addresses, and re-validates on every redirect hop. File operations are path-validated to your active vault, so the app cannot be steered into reading or writing files outside the folder you chose.
Responsible disclosure
Report a vulnerability
Can you read my notes?
No. Your documents live only in a folder on your device. We operate no server that stores them and never receive a copy. Encrypted notes are additionally unreadable on disk without your passphrase.
What happens if I forget my passphrase?
There is no recovery or backdoor by design. The passphrase never leaves your device, so we cannot reset it or recover encrypted content. Keep your passphrase safe, and note that decrypting your own notes is always free.
Does using AI send my whole document to the cloud?
Only if you choose a cloud provider, and then only the specific text you act on is sent, using your own API key. Apple Intelligence and local Ollama models keep everything on your Mac. When a note is encrypted, cloud AI actions are gated behind a confirmation.