Standard
On by default. No passphrase to remember.
Your account gets its own random key. It is stored sealed, two ways: locked with a secret that is kept outside the database, and separately to an offline recovery key held by the founder. Sign in on a new device and it unlocks; there is nothing to type or lose.
We don't read your data, and the database on its own can't reveal it. The honest caveat: someone holding both the database and that separate secret, or the founder's offline key, could read it. That is the price of "no passphrase", and it is also what lets us give your data back if you ask for help.
Strict mode
Optional. The service cannot read your data at all.
Set a passphrase in Settings → Encryption. Your key is re-sealed with that passphrase (plus a one-time recovery code) and the server deletes its own copy of the seal. From then on the service cannot read your account, and every new device must enter the passphrase.
A separate switch, Allow support recovery, decides whether the founder's offline recovery key is kept. Leave it on and we can still restore access when you ask. Turn it off for zero-knowledge: nobody but you can open the account, and losing both the passphrase and the recovery code loses the data. The app says so before you flip it.
Shared lists
Shared with people, not with us.
Every account has a public key. A shared list gets a random key of its own, and that key is sealed to each member's public key by the device of somebody who already holds it. The server stores the seals and cannot open any of them. Everything in the list, tasks, comments and the activity feed, is encrypted under the list key before it leaves a member's device.
Remove someone and the list key is rotated: they see nothing new. What was already on their devices stays there, which is true of every end-to-end encrypted group and we would rather say so. Works the same in Strict mode.
Tasks by e-mail
Optional. The one place mail reaches us readable, and sealed the moment it does.
Turn it on and your account gets a private address; mail sent there becomes a task. E-mail arrives as e-mail, so for the moment it takes our server to parse and seal it, the message is readable there. That is a weaker promise than for everything you type into the app, which our server never sees, and the app says so before you turn it on.
What we store is sealed to your account's public key, the same one shared lists use, so we cannot open it in either mode. Your device collects it, makes the task, and we delete it. We keep when it arrived, its size and how many files it had; never the sender, the subject or a file's name. The address is the secret: replace it any time.
In either mode the service still knows what it needs to run your account: your email and name from Google, Apple or e-mail sign-in, your subscription status, when you sync and how much, and how many encrypted rows of each kind you have. For shared lists it also knows who shares which list with whom and, while an invitation is open, the list's name. For tasks by e-mail, your address and the size and arrival time of each message waiting. Full details in the privacy policy.
The full technical detail, including exactly what the service can still see, is in section 5 of the privacy policy.