A quiet desktop space for writing and reflecting. Encrypted on your machine, reflected back by an AI that doesn't keep your words, and connected to a slow river of other people's honest fragments.
Five practices.
- Writing A journal that's actually private. Every entry is encrypted on your laptop with a passphrase only you know. Lock it, unlock it, write in the morning, lock it again. Nothing syncs. Nothing leaves your machine — until you ask it to.
- Reflection Pass an entry to an AI mirror that responds with what it heard underneath your words. The AI never sees your other entries. The conversation isn't logged. You decide how much it knows, every time.
- Patterns Over time, your writing builds a fingerprint — words you reach for, the rhythm of your sentences, the questions you keep returning to. The app shows it back. The analysis runs on your computer.
- Echoes A slow anonymous river of fragments other journalers chose to release. Read them. Save the ones that hit. Sit with someone else's exact words for what you couldn't name.
- Legacy Letters scheduled to send after a date — a birthday, an anniversary, the moment after you're gone. End-to-end encrypted with a split key. If you cancel before the date, nothing arrives.
How the privacy actually works.
Your vault stays on your machine.
Entries, reflections, goals, todos — all of it lives in
~/HumanLayer/ on your laptop. Encrypted with
XChaCha20-Poly1305, with a key derived from your passphrase via
Argon2id. There is no cloud sync. We don't have copies. If you
forget your passphrase, your data is gone.
The AI mirror is honest about its path.
When you ask for a Mirror reflection, the entry text is sent to Anthropic's Claude API. The app routes through a small proxy I run at proxy.thehumanlayer.co — so you don't need your own API key. The proxy logs metadata (timestamp, IP, response time) but never request bodies. The full privacy commitment is at the link.
Free tier: 30 reflections per IP, rolling 7-day window. If you want unlimited and don't mind providing your own Anthropic API key, the Settings menu has the option — your key stays on your device and routes you direct to Anthropic, bypassing the proxy entirely.
Email captures stay sealed.
When you mail inbox@thehumanlayer.co, the message is
sealed at the edge using your vault's public key — a stock
libsodium 'sealed box'. Cloudflare can see the envelope (who sent
it, when) and stores the sealed blob, but it cannot open the body.
Only your laptop, holding the matching private key, can read it.
Sealed blobs expire after 30 days; once you import or reject one,
it's deleted immediately.
Time capsules use a split-key scheme.
When you queue a letter, the encrypted ciphertext sits on the legacy server. The decryption key is split in half: the server holds one half, the recipient's email link holds the other. Server alone can't decrypt; link alone can't decrypt. You can cancel any time before the release date and nothing ever arrives. Email delivery via Resend.