Tasfer keeps every note on your machine.

No server can read a word.

Open a tab. Open a notes app. Type a half-formed idea, a draft email, a thing you would not say out loud. It lands on a server you do not own, in a city you have never been to, governed by a fourteen-page agreement you did not read. Tasfer refuses that trade.

Public beta. It runs, it syncs, and it will break. Nothing you write here is guaranteed to survive an update.

You wouldn't mail it.

You type it.

You would not hand a notebook to someone in the street. You would not read your medical history into a stranger's phone. You would not shout your half-drafted resignation letter into a crowd.

And yet — every free notes app, every free document, every free AI assistant is a trade. Your thoughts, in plain text, on a machine you will never see, indexed by software you will never read, owned by a company that will outlive you or be outlived by you. The bargain is so quiet you forget you took it.

A grocery list deserves the same dignity as a manifesto.

Tasfer does not take the trade. Not the storage. Not the keys. Not the protocol. Not the permission to leave.

Three places. None of them ours.

On your device. Every keystroke lands in your own storage, instantly — no round-trip, no "saving" spinner reporting back to a server somewhere. Tasfer works on a plane, in a basement, in a Faraday cage.

Between your devices. When you sync, traffic flows peer-to-peer, encrypted with keys that never leave your hardware. Your laptop talks to your phone the way two friends meet — in person, with no third party in the room.

Through a stateless relay — only when a direct path can't be made. It forwards bytes it cannot decrypt. No accounts. No logs. No memory of who connected to whom. It introduces, then forgets. And if you don't trust ours, point Tasfer at your own — it's a config field.

local-first

Every keystroke lands in your storage. Not 'syncs to your storage.' Lands. The network is a choice, not a dependency. Pull the plug and Tasfer keeps working.

end-to-end encrypted

Documents are encrypted on your device before they ever cross a wire. Only the people you share with hold the keys. The relay is structurally unable to read your work — not 'promises not to.' Cannot.

stateless relay

A postman with no inbox. It introduces peers, then forgets they met. No account database. No message log. No surface for a subpoena, a leak, or a curious engineer to land on.

A short inventory of what stays yours.

- your keysEnd-to-end encryption with keys generated on your device. They never leave it. We could not read your notes if a court ordered us to.

- your syncDirect, peer-to-peer, on your timing. Off by default. With the people you pick — and no one else in the room.

- your backupsCopy the folder. Email it to yourself. Print it. Bury it in a tin. Tasfer does not own a single byte you write.

- your forkAGPL-3.0 or MIT. Take the code. Swap the relay for your own. Ship your own build. The license is the point: the refusal is in the code, and the code is yours to keep.

- your right to leaveThere is no account to delete because there was never one to begin with. You walk away by making an export and closing the tab.

- your attentionNo ads. No analytics. No engagement loops. The page you are reading is the last one we will ever ask you to sit through.

Don't trust us. Read the code.

Every privacy promise on the internet is a sentence on a webpage. Ours is a directory of source files. The encryption is in the repo. The relay is in the repo. The protocol is in the repo. Every line that runs between you and the words you wrote is something you can audit, fork, or replace with a build of your own.

Your words.

Your machine.

Your rules.

Install it. Fork it. Swap the relay. Take it offline for a year. Hand it to a friend. Bury it. Walk away. The choice was always supposed to be yours — Tasfer is the editor that finally agrees.