TaskRouteLeft
Draft follow-upLocal model0 bytes
Account briefYour key · cloud2.1 KB
Fetch mailYour IMAP serverdirect
Publish zoneHostingsnapshot
Most security pages describe policies. This one describes an architecture: your data cannot leak from a server we do not have. There is no youdou server holding your book. The database is a file on your disk; the only network surfaces are the ones you opt into, and each is scoped, encrypted and listed below.
youdou is secure by architecture: all records live in a single SQLite database on your disk, API keys and mail credentials are encrypted field by field with AES-256-GCM using a key readable only by your OS user, an optional App Lock derives the key with scrypt, and the Mac and Windows builds are signed and notarized. Only three network surfaces exist, each opt-in and scoped — zones you publish, mail you send and fetch through your own provider, and AI requests to the provider you chose — and the app ships an egress ledger of every outbound call it can make.
All records live in a single SQLite database in your user directory. No proprietary container, no hidden sync — open it, copy it, back it up with standard tools.
API keys and mail credentials are encrypted field by field with AES-256-GCM. The key lives in a local keyfile readable only by your OS user account.
Add a passphrase and the encryption key is derived with scrypt. The app refuses to serve data until unlocked — enforced inside the app’s server, not just hidden in the interface.
The Mac build is notarized by Apple and the Windows build is signed, so the OS verifies the app you run is the app we shipped. External links open in your browser, never inside the app shell.
A zone is a snapshot of exactly the content you chose — never a live tunnel into your file. Passwords are enforced at the transport layer, links are unguessable tokens, and unpublishing takes the content down while keeping the link for a republish.
Your Gmail or Microsoft 365 credentials are stored encrypted on your machine and used to talk directly to your provider. youdou is never in the delivery path and never sees mail server-side.
Each request carries only the context for that request and goes to the provider you configured — your key, encrypted at rest, or a local model with no network at all. Nothing is retained by youdou.
The zone and sharing transport runs on deny-by-default rules: no public listing of anything, per-record access only, writes gated through an authenticated function. Licence records are readable per install — enumeration is off.
Sharing between two youdou installs seals payloads end to end and pins peer keys on first use, so a compromised transport still cannot read or forge what teammates exchange.
Mail sync brings in only the threads tied to accounts already in your file, not your whole mailbox. The less that is pulled, the less there is to protect.
Back up the local keyfile and you keep access; lose it and no one, not even us, can decrypt on your behalf. That is the point, not a bug.
youdou records each AI request — the provider, the model, the host, and whether a single byte left your machine. Choose a local model and the ledger shows exactly that: nothing left. Or point the app at a private endpoint you host.
API keys and mail credentials are encrypted field by field with AES-256-GCM. The key lives in a local keyfile readable only by your OS user account. With App Lock on, the key is derived from your passphrase with scrypt and the app refuses to serve data until unlocked.
Records live in an open SQLite file protected by your operating system’s user account and disk encryption; secrets inside it are encrypted at the field level. There is no proprietary container and no hidden sync.
Only what you opt into: the snapshot content of zones you publish, sealed sharing payloads between installs, and a licence check carrying your install id. Mail goes directly between your machine and your mail provider; AI requests go to the provider you configured.
Yes. The Mac build is notarized by Apple and the Windows build is signed. External links open in your browser, never inside the app shell.
Unguessable token links, passwords enforced at the transport layer, deny-by-default datastore rules with per-record access and no public listing, and writes gated through an authenticated function.
youdou keeps your data on your machine; it does not certify you for anything. What changes is narrower and real: when records never reach a server we run, there is nothing on our side to breach, subpoena or disclose. That is an architecture, not a certification.
Every outbound call the app can make is listed in Settings › Where your data goes.