What we can see, and what we can't.
Pastel Cloud is built so that the contents of your work never reach us in a form we can read. This page explains what that means in practice, including the parts that are still visible to us and the trade-offs that come with it.
We can't see
- What is inside your files, sheets, photos and notes.
- What you write and edit in shared work.
- Your recovery passphrase, your passkeys or the private keys on your devices.
- Your card details. Payments go through our payment provider, not through us.
We can see
- That your account exists, and its public keys.
- How much storage you use, so we can bill for it and warn you before you run out.
- When your devices sync, and which shared group a sealed item belongs to.
- What kind of sealed item each one is (a file, a sheet, a photo), and when it was created or last changed.
- Which accounts share a group, so we can route updates to the right devices.
- Your email address, if you give it to us for the waitlist or billing.
We need this much to run the service, sync your devices and charge for storage. We don't sell it, and we don't use it for ads.
How something stays sealed on the way.
Sealed on your device
When you create or change something, your device encrypts it with keys that only your devices and the people you invite hold.
Synced as sealed boxes
Only the encrypted version travels through our servers. It reaches your other devices, where your keys open it again.
Shared by handing over a key
When you invite someone, your device gives them the key, sealed so that only they can use it. We pass it along without being able to open it.
Removing someone changes the lock
Take a person off a shared folder or album and it gets a new key. They keep nothing new from that point on.
What this asks of you, and what it doesn't.
We can't reset your password
There is no password on our side to reset. When you sign up you create a recovery passphrase or a passkey, and you can add recovery keys later in settings. Keep at least one safe. If you lose every device and every way back in, we can't open your account for you.
Sidekick asks first
Sidekick starts with no model and its tools switched off. You choose a model, and it asks before it uses your sheets or notes. It never moves your work to a different service without telling you.
If you pick a hosted model, what you send it can be read by that service while it answers. We'll always say when that is the case.
Your work keeps working offline
Everything lives on your device first, so it opens without a connection. If our service is down, or a payment fails, you can still read and edit what's on your devices.
No ads, no data sales, no peeking
We'll make money from subscriptions only. We don't show ads, sell data or let anyone else look inside your account. People who pay for a family member's plan don't get to look inside either.
Want a cloud that can't read you?
Leave your email and we'll write when Pastel Cloud opens to its first members. Early places go to people who care about owning their work, and we'll let them in a few at a time.