Privacy

Your content — messages, photos, notes, agreements, task instructions, names — is encrypted on your device with keys the server never has. The server stores ciphertext.

What the server does see, because it has to: your username, who is in which dynamic with which role, short task titles (unless you hide them), deadlines and reminder times, device names and public keys, push tokens and notification preferences, and the timing of the life sign. This is the planning plane; without it no reminder could ever be sent.

No trackers, no analytics, no IP addresses in the database (only hashed for abuse protection, for one day), no location data (EXIF is stripped from photos). An email address is optional. A pseudonym is wise.

Membership and role are readable. Every agreement can be ended unilaterally, and the safeword can never be switched off.

On the waiting list we keep your email address. We use it only for your invitation and news about Luister.