Flanner Mesh

What this service stores

Flanner is sold as an operated service, not as a place to keep your work. The lists below describe the database as it is. There is a test in the codebase that fails if a column starts to look like your writing, and another that fails if any page here could render a line of it.

Stored here accounts, machines, and who may read what
Identity Your email address, and whether you have confirmed it.
People Teams, members, roles, and invitations.
Machines Device identifiers, their public keys, and when each last checked in.
Access Workspace identifiers, an optional label you chose, and who may enter each.
Money Subscription status, seat count, and billing identifiers. Card details stay with the payment provider and never reach us.
Changes A coarse audit trail: who was invited, enrolled, revoked, or removed.
Never stored here not even the shape of it
Your writing Document text, attachments, or any part of one.
Titles File names, titles, summaries, or headers.
Discussion Comments, review decisions, or approval history.
Structure Hashes, manifests, or version graphs. A list of identifiers alone would disclose how much a team is writing and when.
Behaviour Cursors, keystrokes, or anything about editing as it happens.
Your code Repository contents, diffs, or freshness details.
Sync detail Which machines exchanged how much, and when. The relay forwards encrypted bytes and keeps no record of the pairs it served.

Why it is arranged this way

Devices sync directly with each other, and each change is signed by the machine that wrote it. This service issues short-lived entitlements saying who may read which workspace; the devices check those themselves, offline, without asking us. That is why we can decide access without holding your work, and why a breach here would expose accounts rather than anybody's writing.

It also means we cannot recover anything for you. Your machines hold the only copies, which is the trade being made.

You are reading this signed out, on purpose: a promise nobody can read before they trust us is not much of a promise. Sign in.