Security & privacy
This page describes the system as it is built — including the parts that are not end-to-end encrypted yet. If a claim here stops being true, the page changes.
The ledger
Files in your vault Encrypted
XChaCha20 envelope per object — a fresh data key for every file, wrapped by a master key. Thumbnails and derived copies go through the identical seal.
Boards, goals, canvas text Scoped, not yet E2EE
Readable by the sync server, but access-controlled at the row level: the server only ever serves you your own rows. End-to-end encryption for these fields is a designed-for upgrade, not a retrofit.
Auth tokens Memory only
Never written to localStorage or cookies. Closing the tab ends the session.
This website No third-party code
No trackers, no analytics, no ad pixels, no font CDNs, zero external requests. The only JavaScript is a handful of tiny inline snippets — theme, scroll animations, docs navigation — all readable in the page source.
Your files: encrypted, versioned, yours
Every file in the vault is envelope-encrypted at rest: a fresh XChaCha20 key per object, wrapped by a named master key, stored in a namespace that belongs to you alone. Reads are verified against content hashes, so silent corruption is detected rather than served. Images are stripped of EXIF/XMP metadata on ingest.
Versions are immutable — restoring is a pointer flip, not a copy — so your history is auditable and reversible. Deleted files sit in trash for 30 days and are then purged from the index.
Two rights are implemented as endpoints, not policy prose: export your entire vault, and delete your namespace outright.
And the vault isn't locked in the browser: Quest Vault for desktop keeps it as a real folder on your machine — offline-first, delta-synced, with concurrent edits forked visibly instead of clobbered. Devices pair with a short code and hold their own revocable credential; the app never sees your password.
Structured data: scoped, honestly not E2EE yet
The text of your boards, goals and canvas cards lives in the sync database as server-readable data. We could write a vaguer sentence than that; you would find out anyway. What protects it today:
- Row-level security on the sync layer. Every table is filtered server-side to your identity — a subscription cannot be crafted to read another user's rows.
- Owner-guarded writes. Every mutation verifies the caller owns what it touches, in the module, not in the UI.
- Identity derived from claims. Your database identity is cryptographically derived from the auth token's issuer and subject — there is no anonymous write path.
End-to-end encrypting these fields is a designed-for upgrade: search and ranking already run client-side, and conflict resolution never inspects field contents — the two classic blockers don't exist here. Until it ships, the honest description of structured data is scoped and access-controlled, not zero-knowledge.
Identity and sessions
Sign-in is OIDC against our own identity service (at id.getquest.gg) with ES256-signed tokens. Session tokens are held in memory only — never localStorage, never cookies — so closing the tab is a real logout. Google sign-in is optional; using it tells Google that you logged in, and nothing else.
No surveillance
No third-party trackers, no analytics scripts, no ad pixels, no external font or CDN requests — on this site or in the app. This site makes zero external requests; its only JavaScript is a few inline snippets you can read in the page source.
What's still open
Honesty cuts both ways, so: transport encryption everywhere and an encrypted ops-level backup story are launch requirements we hold ourselves to, and field-level E2EE for structured data is a direction, not a shipped feature. This page will track each as it lands.
Want to go deeper?
Everything above is the plain-language version, and it's the whole truth — nothing important is hidden behind jargon. But if you're an engineer (or just curious) and want the mechanism — how identity is derived, how row-level security is enforced, the vault's exact envelope format, the threat model — read the docs.