Here is exactly what protects your notes and your account today — no rounding up. Where something is on the roadmap rather than built, it's labeled that way below.
Passwords are hashed with bcrypt before they ever touch the database. Taggard itself cannot look up, recover, or display your actual password — not even we can see it.
Every read runs through a restricted Postgres role (not the admin role) with Row-Level Security policies applied directly at the database. Postgres itself refuses to return another account's rows, independent of whatever the application code does — a bug in a query can't leak data across accounts, because the database is the one saying no.
Your database connection is TLS-encrypted in transit, and your data is stored on infrastructure that encrypts at rest by default (hosted Postgres on Supabase).
The latent hidden-tag layer Taggard generates to power cross-references and theme discovery is used internally for retrieval — it's not surfaced to other users or any third party, because there are no other users with access to your data at all.
Download every note, tag, entity, and connection as JSON or CSV whenever you want, from the Notes page. Nothing is held hostage in a proprietary format.
Delete any note, folder, tag, or entity permanently at any time from the app itself — no support ticket required.
Your browser will generate the mathematical representation of a document's meaning locally, using transformers.js — the raw text never leaves your device, only the resulting vector does.
For work that can't touch the cloud at all: local models, local vector search, local storage. The internet becomes optional, not required.
Sell your data.
Train AI models on your documents.
Share your content with third parties.
Lock you in — export everything, any time.