Status: Before launch
Scientist keeps your tasks, notes and journal sealed on your own devices. Our server never holds a key, so all it can do is store sealed bytes and hand them back.
Your address is the only thing we collect before launch. Deleted at launch, or the moment you ask.
Thursday
Planned on this Mac
Scientist completely removes that risk.
That is how server-side software works, and it is by design. But it means every breach, subpoena, staff mistake and change of policy is a risk you carry on their behalf. Encrypted at rest protects their disks. It does not protect you from them.
With Scientist, the key to your data is made on your device and stays on your devices.
Your key never reaches us unwrapped.
encrypted at rest, key on their side
readable by staff, by a breach, by a subpoena
sealed on your device, key stays with you
no key here, so nothing to read
A 256-bit master key is generated when you set up, then wrapped by your passkey and by a recovery code you keep. Neither the key nor what opens it is ever uploaded in usable form.
Each edit becomes one encrypted record. Our server appends it to your log, hands out a sequence number and tells your other devices something new exists. It cannot open the record.
Your Mac, iPhone and browser each hold the whole state and do all the planning, search and scheduling locally. Lose the cloud and you lose nothing but sync. Any device can also write the whole log to a file you keep: readable folders for you, a sealed archive for restoring.
There are no passwords anywhere in Scientist. A new device is let in by one you already trust, and the key travels to it sealed, so our server relays a parcel it cannot open. The recovery code you wrote down on day one is for the day every device is gone, not for Tuesdays.
Six digits, on screen, nowhere else. Nothing has been sent yet.
Your Mac shows the same code and asks. One tap, with your passkey, says yes.
Your Mac wraps the master key for that iPhone only. Our server passes the parcel along and forgets it.
A zero-knowledge claim is only worth what it admits. This is the complete list of what our server can ever learn about you, and why it needs each item. It changes only by a decision recorded in the build log.
| What it sees | Why it needs it |
|---|---|
| That an account exists, and when it was made | Needed to store anything at all |
| Sealed records: how many, how large, when | A busy morning is visible as a burst of records |
| How many devices, and when each last synced | Needed to know when old records can be pruned |
| Your passkey's public half | Needed to let you sign in |
| Your drop box's public key | Needed so an extension or an email can seal an item to you |
| Drop-box arrivals: how many, when | A clipped page or a forwarded email is visible as an arrival |
| Your IP address, in logs kept for 7 days | Enough to investigate an incident; no standing history to be compelled |
| Task names, dates, priorities, projects, notes, journal | Never. Not stored, not seen in passing. |
Plan My Day scores every open task on seven dimensions, packs the highest-value ones around your fixed commitments, and nudges the weights from what you actually did. All of it is arithmetic on your own device.
Any AI help runs on an on-device model where your platform offers one, or with a key you bring, sent from your device to a provider you choose after you have seen the exact text it will send. Nothing readable ever passes through us.
starting weights, yours drift
Each evening the planner compares what it proposed with what you did, and moves these a little. It regresses towards the defaults when the evidence is thin, so a strange week does not become a habit.
No dates. Each one ships when its exit test passes, and the build log says which test that is.
13 Sept 2026
The threat model was accepted today and the page follows it. Five things the server always held are now named: which device wrote each record, the account's security-event history, capture credentials and their last-used times, a passkey's signature counter, and the short-lived machinery a request needs.
12 Sept 2026
Cloudflare had been inserting its Web Analytics beacon and a bot-detection script into every page of this site. The content security policy blocked both, so nothing left any browser, but the page as served carried them. Both are off, and the managed robots.txt with them. What we read is Cloudflare's aggregate traffic count, and the privacy page says so.
10 Sept 2026
scienti.st now points at the pre-launch site you are reading, served by a Worker with no third-party requests. The old web service was deleted the same day. The old database was kept on purpose: it holds data the ninth edition has not imported yet, and deleting it would take its backups with it.
Earlier