SANCTUM
Privacy Policy
The short version: Sanctum is local-first. Your writing lives on your Mac, in a folder you choose. We run no servers for your content, require no account, and collect no analytics. We never see your notes.
What Sanctum stores, and where
- Your vault — pages, boards, images, and settings are stored as plain files (Markdown and standard formats) in a folder you pick when you set up Sanctum. It stays on your Mac, under your control.
- App preferences — small configuration files (like which folder your vault is in) are stored locally in Sanctum's own application support area.
- Your AI key (optional) — if you enable Ember and add your own API key, it is stored in the macOS Keychain, never in your notes, your vault, or any server.
Sanctum does not host your notes, pages, boards, or files. There are no Sanctum accounts and no Sanctum cloud.
Syncing between Macs
Sanctum has no built-in sync service. If you place your vault folder inside iCloud Drive, Dropbox, or Google Drive, that cloud provider syncs the files under its own terms and privacy policy. Avoid editing the same vault on two Macs at the exact same time.
When Sanctum talks to the network
Sanctum only makes network requests for features you use, and none of them go to servers we operate:
- Weather (optional) — if you set a ZIP code for the home-screen weather, Sanctum looks up coordinates via zippopotam.us and fetches the forecast from open-meteo.com. Only the ZIP/coordinates are sent.
- Cover image search (optional) — searching for openly-licensed cover art sends your search words to Openverse (openverse.org) and loads result thumbnails from their source hosts.
- Ember AI (optional, off by default) — Ember only works if you add your own API key. Your prompts and the note text you choose to include are sent directly to your chosen AI provider (such as Anthropic or OpenAI) under that provider's terms. Nothing passes through us. Without a key, Ember stays off and Sanctum works fully.
- Links and attachments you add — attaching a URL to your research fetches that page; opening a link hands it to your default browser.
What we don't do
- No analytics, no tracking, no telemetry, no crash reporting.
- No accounts, no sign-in, no user profiles.
- No selling, sharing, or receiving of your data — we never receive it in the first place.
Changes
If this policy changes, the updated version will be posted at this address with a new effective date.