Seams

Privacy Policy

Last updated: 16 October 2026

Draft for review. This document is an engineering-grounded first draft. It is not legal advice and has not yet been reviewed by a lawyer.

Who we are

Seams (“Seams”, “we”, “us”) is operated by [LEGAL NAME], trading as figure.land. For any privacy question or request, contact [CONTACT EMAIL]. For UK/EU data-protection purposes we are the data controller for the limited personal data described below.

The short version

Seams is a local-first, end-to-end-encrypted tool for building ideas. We designed it so that we hold as little of your data as technically possible, and what does reach our servers is encrypted in a form we cannot read.

  • Your content is encrypted on your device before it is sent anywhere. The keys never leave your device. We cannot decrypt your content, and neither can anyone who compromises our servers.
  • We run no analytics, no telemetry, no advertising, and no tracking. The website sets no cookies.
  • The things we necessarily do see are routing metadata (described precisely below) — never the contents of your ideas.

Content you create — unreadable to us

Everything you put into Seams is encrypted on your device using XChaCha20-Poly1305 authenticated encryption, with keys that never leave your device. When your devices sync, only the resulting ciphertext is transmitted to and stored on the relay. We cannot read, decrypt, index, profile, scan, or sell your content — it is not technically possible for us to do so, because we do not hold the keys.

Routing metadata the relay can see

To route and sync encrypted data, each change carries a small, unavoidable envelope of metadata in the clear. The relay can see, per change:

  • an opaque operation identifier;
  • a timestamp;
  • an opaque identifier for the device that made it;
  • the type of change (create, edit, delete) — but not what was changed;
  • a blinded tag that lets the relay group changes to the same object without learning the object’s real identity or contents, and which cannot be correlated across vaults.

An observer with full access to the relay could infer coarse patterns — roughly how much and how often you write, from how many devices — but not the content, titles, structure, or real identifiers of your ideas.

Authentication & operational data

Each request your device makes is cryptographically signed so the relay can verify it is authorised. These signatures are access-control metadata, never content, and the relay verifies them statelessly — it keeps no durable database of devices, grants, or signatures. Our hosting provider and server process the standard technical data needed to run an internet service (e.g. connection metadata and IP addresses at the network edge); we do not use this to profile you, and the relay keeps no per-request access log of users.

Data on your own device

Your content and encryption keys are stored locally on your device. Please note: this local database is not itself encrypted at rest by Seams, and keys are stored alongside content, so your protection at rest depends on your operating system and disk encryption (e.g. FileVault on macOS). We recommend enabling full-disk encryption.

Accounts, sharing & recovery — not yet available

Seams does not yet offer accounts, sign-in, sharing, invitations, or recovery. Pages referring to these are placeholders for features that are not built and collect no data today. When they launch, this policy will be updated first. The planned model is privacy-first: accounts anchored on an email address (used only for access, kept separate from your keys), with a one-time recovery key shown to you once and your master key stored on our servers only in a form we cannot read.

What we do not do

  • No analytics, telemetry, crash/error reporting, session recording, or fingerprinting.
  • No advertising or marketing trackers.
  • No third-party scripts, tag managers, or third-party-CDN fonts.
  • No cookies on the website.
  • We do not sell, rent, or share your personal data with third parties for their own purposes.

Processors

We use only the providers needed to run Seams, acting on our instructions:

  • Railway — cloud hosting for the relay, website, and database, in the europe-west4 (Netherlands, EU) region.
  • GitHub — hosts our code and app downloads (governed by GitHub’s own privacy policy).

Retention & deletion

On the relay, encrypted data is stored durably and not automatically deleted today. There is currently no self-service “delete my data” button; we can erase a vault’s encrypted data from the relay on request — contact [CONTACT EMAIL]. On your device, you can delete your local Seams database at any time to remove your local copy (including your keys).

Your rights

Subject to law, you have rights to access, correct, delete, restrict, and port your data, and to object to certain processing. Because most of what we hold is unreadable ciphertext or not tied to an identity, some requests may be limited by what is technically possible; we will always explain what we can and cannot do. Contact [CONTACT EMAIL]. In the UK you may also complain to the ICO.

Security & changes

We use modern cryptography (XChaCha20-Poly1305, Ed25519, X25519) and a blind-relay architecture to minimise exposure. No system is perfectly secure; see the note above about local-at-rest storage. To report a security issue, contact [SECURITY CONTACT EMAIL]. We will post any changes to this policy here and update the date above, and will make material changes clear before they take effect.

Contact

[CONTACT EMAIL] · figure.land