When Privacy Feels Personal

Almost everything written about privacy is written in one of two registers. The first is technical: key derivation, cipher suites, transport security, threat models, the architecture of who can read what under which conditions. The second is legal: data residency, retention schedules, breach notification, the frameworks that decide which obligations attach to which categories of information. Both registers are necessary and both are well developed, staffed by serious people who have thought carefully about hard problems. Neither of them has much to say about what privacy feels like, which is odd, because the feeling is what most people are actually responding to when they choose one tool over another.

Consider a small experiment that costs nothing to run. Write a paragraph about something you are genuinely ashamed of, in a document you know is stored on a server belonging to a company. Then write the same paragraph in a notebook you keep in a drawer. The words will not be the same. Most people, asked to predict this, will say the difference would be slight, and most people, having actually tried it, report that the difference is considerable. The version written on the server is shaped by an audience that does not exist and will probably never exist: an imagined reader, benign, statistical, unlikely, and nevertheless present enough to soften a sentence, drop a name, choose a milder verb. The version in the drawer is written to nobody. It is worse prose and it is truer.

This effect has been studied in adjacent forms for a long time under various names, and the general finding is unsurprising once stated: people behave differently when they believe they may be observed, and the behavioural change persists even when observation is merely possible rather than actual, and even when the observer is understood to be indifferent. What matters is not whether anyone is watching. What matters is whether the writer can stop modelling a watcher. That modelling is largely automatic, it happens below the level of deliberate thought, and it does not switch off in response to reassurance. A person can know intellectually that no human being will ever read a particular document and still write it for someone.

Which means that for certain categories of writing, privacy is not a protective measure applied to work that would otherwise be identical. It is a precondition for the work existing in the form it needs to take. A memoir that omits the regret is not a memoir with one thing missing; it is a different and considerably less useful book. A clinical note that softens an observation because a reviewer might read it later is not a slightly diplomatic note; it is a less accurate clinical record, and the inaccuracy will be invisible precisely because it was introduced by the person best placed to detect it. A journal entry written for an imagined future audience is a performance, and everyone who has kept one knows the specific hollowness of rereading a passage and recognising that the writer was already curating.

The technical and legal registers cannot reach this. Compliance frameworks establish who may access data and under what circumstances, which is essential and entirely beside the point at hand. The question is not whether the access will occur. The question is whether the writer can stop calculating. A promise cannot achieve that, because a promise is precisely the kind of thing a person continues to evaluate. Terms of service, however scrupulous, are a statement of intention by an organization that may be acquired, restructured, subpoenaed, or simply changed, and some part of any thoughtful writer’s attention remains permanently allocated to that possibility. The allocation is small. It is also constant, and it is enough.

What removes it is not a stronger assurance but a structural one. If the material never leaves the machine, if there is no server holding a copy, if the file is encrypted at rest under a key the writer controls, and if none of this depends on any organization continuing to behave well, then the calculation has nothing to work on and eventually stops running. The relief people describe when this happens is disproportionate to the technical change involved, and that disproportion is the interesting part. It suggests that a substantial amount of cognitive effort had been going into something nobody had named.

There is a further dimension that gets even less attention, which concerns not secrecy but attention. Privacy also means not being analyzed. A tool that reads what you write in order to summarize it, categorize it, or surface insights from it is not necessarily invading anything, and it is nonetheless doing something to the writing. Fragments become noise to be filtered. Half-formed paragraphs become candidates for improvement. Emotional reactions recorded in the margin become anomalies. Anyone who thinks by writing badly first, which is most people who think by writing at all, will eventually notice that a system with opinions about quality is shaping what gets written down.

All of which is more easily demonstrated than argued, and it is best demonstrated by people who write things they have no intention of showing anyone, and who can say precisely what changed when they stopped writing for a room that was not there.

A courtyard in Austin, in the wrong month for it

The literary festival occupied four venues along a street that had been closed to traffic for the weekend, and by the middle of Saturday the whole arrangement had taken on the pleasant disorder of an event slightly larger than its planning. There were folding chairs in a converted warehouse. There was a queue for a bookshop tent that stretched past a taco stand and had stopped being a queue and become a social occasion. October in central Texas had declined to cool down on schedule, and every session with air conditioning was full within four minutes of doors.

Dr. Felix Brennan read at two in the afternoon in a room built for a hundred and holding about seventy, which he considered a respectable result for a man with no book yet and no reputation outside a discipline most of the audience had never studied. He read for twenty minutes from a chapter in progress. It concerned a department, a woman named Harriet who had hired him and fought him for six years, and a photograph he had found on the back of which she had written four names in pencil, one of them his own. He did not perform it. He read it the way he had read papers at conferences for forty years, which is to say clearly, without ornament, and with the occasional pause where he had evidently written something he still found difficult.

At the end a young man asked how long the book had taken. Felix said two years so far and probably two more, and the audience laughed at the tone rather than the answer. Somebody asked whether he had used a ghostwriter. He said no with more force than the question required and then apologised for the force.

Afterward there was the usual small clot of people at the front, and he answered them one at a time in the order they had arrived, which was a discipline from a different profession and made the group visibly calmer. The woman at the back waited without shifting her weight, which he noticed. When the others had gone she stepped forward and put out a hand.

‘Dr. Iyer. Meera. I am a psychiatrist here in Austin.’

‘Felix. And you have been standing there for eleven minutes, which suggests you are not here to ask about the ghostwriter.’

‘No.’ She smiled. ‘I wanted to ask what you write it in.’

Felix’s expression did something complicated and then settled into open delight.

‘Ah,’ he said. ‘You already know.’

‘I recognised a phrase. You said you had gone looking for one thing and been handed another by the file, and there is only one tool I know of that does that to people.’ She adjusted the strap of her bag. ‘A colleague of mine, Suki Tanaka, has developed an unpaid second career introducing users to each other. She mentioned that a retired professor in Vermont was writing a memoir in it and that I would find the conversation interesting. I did not expect to be in a room with him this month.’

‘Suki,’ Felix said. ‘I have exchanged perhaps nine messages with Suki and each one has been shorter than the last, and I consider us close.’

Meera laughed properly, which surprised her.

‘There is a courtyard behind the third venue,’ she said. ‘It has shade and it has iced chai, which is the only reason I know it exists.’

‘Lead on. I have four hours before anyone wants me again and I have been talking to strangers about a book that does not exist since Thursday.’

The courtyard was gravel and mesquite, with a low wall along one side and half a dozen tables that had been arranged by somebody with an eye and then rearranged by everybody who had used them since. They took the one furthest from the door. Meera ordered the chai. Felix ordered coffee and then looked at hers when it came and admitted he had made an error.

‘You did,’ she agreed. ‘Nobody in this city can make coffee in October. It is a matter of ambient temperature and disappointment.’

They talked for a while about the festival, and about Vermont, and about the peculiar experience of reading unfinished work aloud to people who assume it is finished. And then Meera set her glass down and asked the question she had actually come to ask, in the flat, unhurried, entirely unthreatening way she asked things for a living.

‘When you were reading,’ she said, ‘there was a passage you did not read. You stopped, you looked at the page, and you skipped about a paragraph and picked up cleanly on the other side. Nobody noticed. I noticed because noticing that is what I do.’

Felix looked at her for a moment.

‘You are going to be very good company,’ he said.

The paragraph he did not read

‘It was about a hiring decision,’ Felix said. ‘Nineteen years ago. There were two candidates and I preferred one and I said nothing when the committee went the other way, because saying something would have cost me a relationship I valued more than I valued being right. The one we did not hire had a considerably worse career than she should have had. I have thought about it perhaps two hundred times and I have never said it out loud to anyone including my wife.’

‘And it is written down.’

‘It is written down in more detail than I have just given you, and with names, and with the part where I understood at the time exactly what I was doing.’ He turned his cup a quarter turn. ‘I could not have written it in anything connected to the internet. I want to be precise about that, because it sounds like a security posture and it is not one. Nobody is looking for it. There is no adversary. There is no plausible circumstance in which a company’s server administrators develop an interest in a retired historian’s opinion of a search committee in a state most of them could not locate.’

‘But you could not write it.’

‘I could not write it,’ Felix said. ‘I tried, actually, before I knew there was any alternative. I sat with a document open in one of the usual things and I wrote a version of that paragraph, and it was three sentences long and it was diplomatic and it was a lie of exactly the kind that makes a memoir worthless. I had written it for somebody. I could not have told you who. Some notional person, in some notional future, reading over my shoulder with a mild professional interest.’

Meera nodded slowly. She had heard variations of this sentence in her consulting room several hundred times, in different clothes.

‘What changed?’

‘Architecture, and I mean that literally rather than as a figure of speech.’ Felix set the cup down. ‘VaultBook is one file. It runs on my machine, it writes into a folder on my machine, and it makes no contact with a server. Not less contact. None. There is nothing to which my sentences are transmitted, because there is no transmission, and the thing that makes that credible is not a promise in a document I would have to trust. It is that the software has no mechanism for it.’

‘And the entries are encrypted.’

‘Per entry, and this is the part that turned out to matter emotionally rather than technically.’ He held up a hand, ticking it off in a manner she recognised from the reading. ‘Encryption at the level of the vault would have satisfied me intellectually. Encryption at the level of the individual entry means that the chapter about that hiring decision is locked separately from the chapter about the alpine research station, and I unlock the one I am working on. The others stay closed. Which means that on a morning when I am writing about a mountain hut and a generator, the difficult material is not merely protected, it is not open. It is not in the room.’

Meera set her chai down.

‘Say that again.’

‘It is not in the room,’ Felix repeated. ‘When everything is behind one door, the door is either open or shut, and while you are working the door is open, and everything you have ever written is standing behind you in the same space. Per-entry encryption means that opening one thing does not open everything. I had not anticipated that and it changed how the work feels considerably more than it changed how secure it is.’

‘That is a therapeutic observation,’ Meera said. ‘I will come back to it. Tell me about the lock screen, because I suspect I know why you use it and I want to hear you say it.’

Felix laughed.

‘My wife,’ he said. ‘Ellen. Forty-one years, and I have no secrets from her worth the name, and I still press the lock when I hear her on the stairs.’

‘Why?’

‘Because if I do not, there is a paragraph on the screen, and it is a paragraph about her mother, or about a decision I regret, or about a colleague she liked more than I did, and it is a paragraph in a state I would not choose to show anybody, which is unfinished.’ He shook his head. ‘She would never read it. She has never once tried. It does not matter. The visibility is the problem, not the reading. A screen with words on it in a room with another person in it is a document that has been published, and once I know that could happen I write differently all afternoon.’

‘And the lock solves it.’

‘Instantly, and physically, which matters.’ He described it: one action, the whole viewport covered, the content blurred out, the interface refusing pointer events until the session is authenticated again. ‘It is not a screensaver and it is not a courtesy. Nothing behind it can be clicked, selected, or read. And it takes less time than looking up does, which is the only reason I actually use it, because a safety measure that requires a decision is a safety measure nobody performs at speed.’

Meera was quiet for a moment.

‘I want to say something that may sound like a diagnosis and is not one,’ she said. ‘What you are describing is not secrecy. Secrecy has a target. There is someone you are keeping something from and a reason. You have no target. What you are describing is closer to what I would call a holding environment.’

‘Explain that.’

‘It is a term for the conditions that make it possible for someone to say a difficult thing.’ She turned her glass slowly on the table. ‘Not the encouragement to say it, not the request for it. The conditions. A room with a door that closes. A guarantee that nothing said in it goes anywhere. A person who will not react in a way that costs you. Under those conditions people say things they have carried for decades, and the striking part, the part that surprises every trainee, is that they usually wanted to say them the whole time. They were not withholding. They were waiting for somewhere to put it.’

Felix did not respond immediately. Somewhere on the other side of the wall a queue was laughing at something.

‘That is exactly it,’ he said eventually. ‘I had assumed for two years that I was a coward who had found a way to be brave. What you are telling me is that I was a normal person who had not been given a room.’

‘I would not have used the word coward.’

‘No,’ Felix said. ‘I would have. That is rather the point.’

The precondition, described by someone who arranges it professionally

Meera did not present her side as a parallel. She presented it as the same phenomenon observed from the other chair, which Felix found more persuasive than an analogy would have been.

‘The thing nobody outside the work understands about therapy,’ she said, ‘is how much of it is logistics. People imagine it as insight, and the insight is real, but the insight arrives late and it arrives only if the earlier conditions were arranged correctly. Most of what a good clinician does in the first several sessions is establish that this room is different from other rooms. That what is said here does not travel. That there is no cost to the sentence.’

‘And if the conditions are not there?’

‘Then people tell you the version of their life that they tell everyone. It is not a lie. It is a well-rehearsed account that has been sanded down by twenty years of telling, and it contains nothing they have not already resolved.’ She lifted a shoulder. ‘You can work with that account for a year and make no progress at all, because the material that would move things is not in it and will not be until safety is genuinely established rather than merely asserted.’

‘Asserted being the operative word.’

‘Asserted is worthless,’ Meera said. ‘I can tell a patient that this is confidential, and I do, because I am obliged to. It changes nothing on its own. What changes something is the accumulated evidence: the eleventh session where the difficult thing was said and nothing bad happened. Safety is a conclusion people reach from evidence, not a fact they accept from an announcement. This is why I am unmoved by privacy policies.’

Felix laughed at that.

‘Say more about the notes,’ he said. ‘Because I assume this applies to your side of the transcript as much as theirs.’

It applied more, she said, and it had taken her some time to admit it.

‘I write session notes after every appointment. They serve several functions and the functions are in tension.’ She counted them off. ‘There is a record required for continuity of care, so that in four months I know what we covered. There is material required for billing and administration, which is a different document with different readers. And there is what I would call clinical thinking: my actual assessment, my hypotheses, what I noticed that I am not yet confident about, what I got wrong last time, and occasionally what I felt in the room, which is clinical data and not sentiment.’

‘The last one being the one that matters.’

‘The last one being the one that is worth anything and the first one to disappear the moment I believe somebody might read it,’ Meera said. ‘And that is not paranoia. Clinical notes are read. They are read by reviewers, by administrators, by other clinicians, occasionally by lawyers, sometimes by the patient. Every one of those readings is legitimate. Their combined effect on my writing was that I produced, for several years, notes that were technically complete and clinically thin.’

‘How did you notice?’

‘I noticed because I stopped being able to use my own notes.’ She said it plainly, and Felix understood that this was a thing she had thought about carefully and did not enjoy. ‘I would open a note from three months earlier looking for what I had actually been thinking, and find a competent summary of what had been discussed, and nothing at all about why I had gone in the direction I had gone. I had written it for the reviewer. The reviewer never came. The note was useless to the only person who ever actually opened it.’

Felix made a small sound of recognition.

‘Three sentences and diplomatic.’

‘Three sentences and diplomatic,’ she agreed.

What she did now, she explained, used sections inside a single entry, which was the structural answer to a problem she had previously tried to solve by keeping two systems.

‘One entry per patient, sections beneath it per session date,’ she said. ‘And within a session, separate sections for separate purposes. What happened, which is the record. What I am thinking, which is clinical reasoning. What I noticed in myself, which goes to supervision. Administrative matters, which is scheduling and billing and is the least interesting text I produce.’

‘The reactions are in there.’

‘The reactions are in there and they are the reason the whole arrangement had to be private.’ She paused. ‘A clinician who feels nothing in a session is not being professional, they are being absent. What I feel is information about what is happening in the room, and it belongs in the record of my thinking. It does not belong in a document that an insurance reviewer may open, not because it is embarrassing but because it will be misread by a reader who is not looking for that and has no training in interpreting it.’

‘And per-entry encryption means the whole patient is behind one door.’

‘Which brings me to the thing I did not expect, and which you described first.’ Meera leaned forward slightly. ‘Unlocking is a ritual. I open a patient’s entry, I enter the password, and there is a moment, perhaps two seconds, in which I have done something deliberate. I am now attending to this person. Nothing else is open. When I finish and the session ends, that material closes again.’

‘You are describing a door.’

‘I am describing a door, and I had one before, physically, in the building. What I did not have was a door around the record.’ She turned the glass again. ‘Before this, my notes for forty patients were a single undifferentiated body of text that was either accessible or not accessible. Which means that at any moment while I worked, everything anyone had ever told me was equally present. That is not how the obligation feels. The obligation is particular. It is to this person, about this hour.’

‘And the password caching?’

‘Holds for the session, so I am not typing it eleven times during a morning, which would turn a ritual into an irritation and I would start looking for ways around it.’ She said this with the practicality of someone who has watched colleagues route around badly designed security for thirty years. ‘Any protection that is annoying will be defeated by the person it protects. The design has to be tolerable at the frequency you actually use it.’

Felix was quiet for a moment.

‘Do you write more now?’

‘I write considerably more and considerably worse,’ Meera said, ‘and the notes are enormously better. Those are the same sentence. When the writing stopped being a performance for an absent reader it became messy, provisional, and full of things I might be wrong about. That is what clinical thinking looks like when it is written honestly. The tidy version was tidy because it had been emptied.’

The thing that arrives without being asked for

The light had moved across the courtyard by then, and a man with a guitar had begun setting up somewhere beyond the wall with the unhurried confidence of someone who would not be starting for another hour.

‘I want to tell you about the feature I would not have predicted caring about,’ Felix said, ‘because you will have a word for what it does and I have been reaching for one for two years.’

He described the random note spotlight: a widget in the sidebar showing one entry drawn at random from the whole library, refreshing each hour, with a small marker indicating a fresh pick. He described his morning ritual, which was to read whatever it offered before touching the manuscript, and to write a few lines about it regardless of whether it seemed worth anything. He described the several hundred mornings on which it had been a photocopier memorandum.

‘And then,’ he said, ‘there are the other mornings.’

He told her about one. He had been three weeks into a chapter that would not hold together, about a period in the middle of his career that he understood historically and could not make mean anything. The widget refreshed while he was doing something else, and when he came back it was showing an entry with a title he did not recognise, from a batch he had scanned mechanically over several evenings without reading.

It was a note he had written himself, years earlier, immediately after a conversation with a colleague in a corridor. Four paragraphs. The colleague had been ill and neither of them had said so. They had talked about a curriculum problem for eleven minutes and then the man had said something about his father, apropos of nothing, and then they had gone to their respective offices. He had died about five months later.

‘I had forgotten the conversation entirely,’ Felix said. ‘Not partly. There was no trace of it. And I had written it down that afternoon, which means at the time I knew it mattered, and then forty years of other things happened on top of it.’

‘What did it do?’

‘It gave me the chapter.’ He said it simply. ‘Not material for the chapter. The chapter. The thing I could not make mean anything turned out to be about the way institutions absorb people who are dying and keep discussing curriculum, and I could not have arrived at that from an outline because I did not know I believed it until I read four paragraphs I did not remember writing.’

Meera had gone very still in the way that professionals do when something in their own field walks past.

‘You know what you are describing.’

‘I have a suspicion and I have been resisting it because it sounds pretentious.’

‘Say it anyway.’

‘Involuntary memory,’ Felix said. ‘The Proustian thing, which every undergraduate mentions and almost nobody has thought about carefully. The insight is not that a taste can produce a memory. The insight is that the memories you can summon deliberately are a small, curated, heavily rewritten subset, and the ones with any force in them arrive sideways, triggered by something you were not using as a trigger.’

‘And a random widget is a machine for producing that condition.’

‘A crude one and an effective one.’ He spread his hands. ‘It has no idea what it is doing. That is precisely why it works. If it were selecting intelligently, it would select what I appear to be interested in, which is what I already know I am interested in, which is the small curated subset. Its stupidity is the feature.’

Meera laughed, and then thought about it properly.

‘We do a version of this deliberately,’ she said. ‘Not randomly, but the mechanism is closer than you would expect. A great deal of clinical work is helping someone put two things beside each other that have never been beside each other. They have both memories. They have had both for thirty years. What they have never had is the two of them in the same moment of attention, and when that happens the effect is not information, it is recognition, and recognition does something that information cannot.’

‘Because the connection was always there.’

‘Because the connection was always there and nothing had ever occasioned it,’ Meera said. ‘That is the entire trick, and it is why the good moments in therapy feel like remembering rather than learning. Your widget is doing the occasioning. It is putting a thing in front of you at a moment when you are holding something else, and the collision is yours.’

Felix described the two habits that had grown around it. Anything the spotlight surfaced that turned out to matter got starred immediately and went into the Favorites panel, because the selection was random and would not reliably return, and because he had learned not to trust his own intention to remember. And at the end of a session he would look at the Recently Read page in the suggestions pager, which showed where he had actually been.

‘Twice now that trail has told me something,’ he said. ‘Four entries, apparently unconnected, read in one afternoon because each one led to the next. And looking at the list afterward the connection was obvious and I had been inside it without seeing it. The chapter was the connection, not any of the four.’

‘That is supervision,’ Meera said.

‘I beg your pardon?’

‘That is what supervision is for. You describe four sessions to someone outside them and they say, gently, that you have described the same thing four times.’ She smiled. ‘You have built a supervisor out of a list of what you read.’

In defence of writing badly on purpose

The chai arrived a second time, unasked, which Meera took as evidence that the courtyard was a good one.

‘I want to defend something,’ Felix said, ‘and I suspect you will agree with me before I finish, which will spoil the pleasure of arguing.’

‘I will pretend to resist.’

‘My early entries are appalling.’ He seemed genuinely pleased about this. ‘I went back through the first four months recently and a substantial fraction of what I wrote is not writing at all. Fragments. A name and a question mark. Two lines that contradict each other. One entry that consists of the words check whether this is why and nothing else, and I have no idea what this refers to.’

‘Did you delete any of it?’

‘Not one.’ He shook his head. ‘And here is the part that I think matters. In a system that did something with my writing, those fragments would be a problem. They would be incomplete items. Candidates for cleanup. Low-quality inputs to whatever the system produces. And the pressure would be gentle and constant and I would eventually stop writing them, because nobody wants to feed a machine material it will treat as noise.’

‘Whereas.’

‘Whereas nothing looks at them. They sit there. They are seeds, and about one in twenty of them germinates two years later when something else lands next to it.’ He turned his hand over. ‘The fragment is not a failed note. It is the only available form for a thought that has not finished arriving. If the tool has opinions about quality, the thoughts that have not finished arriving do not get written down, and those are disproportionately the interesting ones.’

Meera was nodding before he finished.

‘I have the clinical version of this and it took me years to permit myself.’ She described it: within a session entry, alongside the record and the reasoning, a section for what she had noticed in herself. Not conclusions. Reactions. Irritation she could not account for. A moment of unexpected sadness. The observation that she had wanted the hour to end, and the question of why.

‘Those sections are half-sentences,’ she said. ‘Deliberately. If I write them properly I have already interpreted them, and the interpretation at the time is nearly always wrong. What is useful is the raw observation, kept unprocessed, so that when I take it to supervision six weeks later it has not been tidied into a story.’

‘And they would be catastrophic in the wrong hands.’

‘They would not be catastrophic. They would be misread,’ Meera said, ‘which is worse in a specific way, because a misreading arrives with confidence and there is no opportunity to explain. A reviewer encountering a line about my own irritation is not equipped to know that this is a standard clinical instrument and not a lapse. So in any system where that reading is possible, I do not write the line. And not writing the line makes me a worse clinician, quietly, over years.’

Felix set his cup down.

‘That is a considerable claim.’

‘It is the one I would defend hardest,’ she said. ‘The material a clinician suppresses is not distributed randomly. It is precisely the material about their own uncertainty and their own reactions, which is precisely the material that supervision exists to examine. A system that discourages it does not slightly reduce the quality of the record. It removes the part of the record that produces improvement.’

They talked for a while about the mechanics of keeping different kinds of writing distinct without separating them, which both had arrived at through the same structure and neither had planned.

‘Sections are the answer to a problem I had solved badly for years with two applications,’ Meera said. ‘Record in one place, thinking in another. Which meant the thinking was never beside the thing it was thinking about, and it drifted, and eventually I stopped keeping it. Now it is one entry, and within it the parts are separate but adjacent, and each part carries its own attachments where it needs them.’

‘Mine is the same shape,’ Felix said. ‘Recollection, evidence, what somebody else said about it, and what I currently think, which is dated because it keeps changing. Four sections, one event, and the honesty comes from keeping them apart. If I merge my memory with the document I have written something confident and false.’

‘That is a discipline, not a feature.’

‘Most of the useful things are,’ Felix said. ‘The feature merely made the discipline possible to sustain. I have kept notebooks for fifty years and I abandoned every system I ever imposed on them within about four months. This one has held for two years and the reason is not virtue. The reason is that the shape of the tool and the shape of the thought are not fighting.’

Two different assumptions about what a drawer is

The guitar had started, badly, and neither of them minded.

‘May I ask you something generational,’ Meera said, ‘and you may find it rude.’

‘I would enjoy that.’

‘You are seventy-two. I am forty-four. I have a suspicion that we mean different things by privacy and that we have arrived at the same place from opposite directions.’

Felix considered it.

‘I think you are right, and I think the difference is what we each regard as the default,’ he said. ‘I grew up with privacy as a physical fact requiring no arrangement. Letters were in a drawer. A notebook sat on a shelf. If somebody wished to read my correspondence they had to enter my house and open a piece of furniture, which is a considerable social and physical undertaking, and I did not think about it because there was nothing to think about. Privacy was not a feature. It was a property of objects.’

‘And then.’

‘And then, over perhaps fifteen years, everything I wrote moved into arrangements where the default reversed, and I never once consented to that. Nobody asked. It happened as a side effect of adopting tools that were better in other respects.’ He shrugged. ‘I want to be fair. I gained a great deal. Searching a drawer is impossible, and I can search forty years now, which is the reason this book exists at all. But the exposure came with it as a condition, and it was presented as normal rather than as a trade.’

Meera nodded slowly.

‘My assumption was the opposite from the beginning,’ she said. ‘I have never in my adult life had the experience of writing something digitally and assuming it was mine. The default I grew up with is that digital means a copy exists somewhere, and probably several, and that the question is not whether but who and under what terms. That is not cynicism. It was simply accurate.’

‘Which makes it stranger that you ended up here.’

‘It makes it less strange, I think.’ She considered how to say it. ‘Because I never had the older experience, I did not know what I was missing, and I would have told you I was not missing anything. I had adapted. I self-censored efficiently and without noticing, the way you stop hearing a noise. What was disorienting was not gaining privacy. It was discovering, afterward, how much effort had been going into managing its absence.’

‘Ah,’ said Felix.

‘I had a physical response the first time I wrote a genuinely unguarded clinical note,’ Meera said. ‘Something in my shoulders. And I sat there and thought, this is what my colleagues in their seventies mean when they talk about paper.’

Felix laughed, and then stopped laughing.

‘That is going in the book.’

‘I assumed it would be.’

‘Not the shoulders. The other part. That you had adapted so well you could not detect the cost.’ He looked at the table for a moment. ‘Because that is the strongest version of the argument, and it is not available to me. I can only say that I remember a drawer. You can say that you never had one and that the absence was still costing you.’

‘Both of us ended up in the same place,’ Meera said. ‘On a machine, in a folder, with a file that does not report anywhere. Which is a drawer.’

‘It is a drawer that can be searched,’ Felix said, ‘and I would like the record to show that this is the best thing that has happened to me since I retired.’

A demonstration, on a network that was not working

The festival wifi had collapsed sometime around noon under the weight of four hundred people photographing a queue, and by mid-afternoon the venue staff had stopped apologising and started shrugging, which Felix considered the more honest position.

‘I have my laptop,’ he said. ‘I brought it in case anyone asked me a question I could not answer from memory, which is now most questions. Would you like to see it, or is that the conversational equivalent of showing somebody photographs of a holiday.’

‘I would like to see it,’ Meera said, ‘and I would like to see it specifically because the network is down, which makes this the better demonstration.’

He opened it on the table between them, angled away from the door out of habit, and Meera watched him not do several things. He did not wait. He did not check a connection indicator. He did not encounter a message explaining that changes would sync when a connection was restored, which she had been shown by three previous applications in her professional life and had learned to read as a small confession.

‘It is one file,’ he said. ‘It opens, it asks whether it may connect to the folder it uses, I say yes, and it is working. That is the entire startup sequence and it is identical in a farmhouse in Vermont during a power flicker and in a courtyard in Austin with no network at all.’

‘Where is the folder?’

‘On this machine, and also on a drive in a drawer at home, because I copy it, which is possible because it is a folder.’ He said the last part with some emphasis. ‘I want to be clear that backing this up is not a feature I use. It is a consequence of the material being files. I copy a folder. That is the whole procedure and it works with anything that copies folders.’

The sidebar showed the tree, collapsed. Meera recognised the shape immediately from her own, which she said, and Felix said that Claire Fontaine had said the same thing on a telephone call and had been slightly annoyed about it.

Then he opened an entry and it asked for a password.

‘This is the part I described,’ he said. ‘Watch the interval rather than the mechanism.’

He typed, and there was a pause of perhaps two seconds while the key was derived and the content decrypted, and then the entry opened.

Meera found herself unexpectedly interested in the pause.

‘That is not a delay,’ she said. ‘That is a threshold.’

‘Go on.’

‘In clinical settings we spend a great deal of effort constructing thresholds, and we usually do it with architecture because nothing else works.’ She gestured vaguely at the courtyard. ‘A waiting room. A corridor. A door that takes a moment to close. None of those are functional requirements. They exist because attention does not switch instantly and a transition needs somewhere to happen. A patient who walks directly from a lift into a session brings the lift with them.’

‘And two seconds is enough?’

‘Two seconds with a deliberate act attached to it is enough,’ Meera said. ‘That is the finding that surprises everyone. The interval does not need to be long. It needs to be marked. Typing a password specific to this material, and waiting while it opens, is a marked transition, and I would guess without asking that you write differently in the first minute afterward than you would if the entry had simply been sitting open.’

Felix thought about it honestly.

‘I do,’ he said. ‘I had noticed it and I had attributed it to the material rather than the door.’

He showed her the lock next, which took a fraction of a second and covered everything, and then a colleague of hers walked past the courtyard entrance and glanced over, and Felix realised he had already pressed it before consciously deciding to, which made both of them laugh.

‘That is the whole argument in one gesture,’ Meera said. ‘You did not evaluate a threat. Your hand moved.’

‘It has become entirely automatic,’ he admitted. ‘I press it when the postman comes to the door of a house he cannot see into.’

‘I press it when I hear the outer office,’ Meera said. ‘Every time, whether or not anyone is coming in. And I want to say something about that, because it is the piece I would put at the centre if I were writing this up rather than living it.’

‘Please.’

‘A protection you use automatically is a protection that has stopped costing you attention.’ She said it with the precision of a formulation she had clearly arrived at some time ago. ‘While you are still deciding whether to lock the screen, you are monitoring the room. Once the gesture is automatic, you are not monitoring anything, because the response is already handled. What people describe as feeling safe is very often just this: the point at which a vigilance loop stops running because something else is reliably handling the thing it was watching for.’

Felix closed the laptop and looked at her.

‘You have just explained to me, in a courtyard, what two years of writing has felt like.’

‘I have explained why it felt like that,’ Meera said. ‘You did the writing.’

The page each of them keeps that nobody commissioned

It was Meera who admitted it first, and only because Felix had described his page structure and she had recognised something in the list.

‘You have a page called Loose ends.’

‘I do.’ He looked mildly caught out. ‘Eight top-level pages. Seven of them are the book. The eighth is not.’

‘What is in it?’

‘Everything that is not for the book and that I write anyway,’ Felix said. ‘Which turns out to be a substantial fraction of what I produce. Sub-pages beneath it. One for people I have not forgiven, which is a shorter list than it was two years ago and I attribute that entirely to having written it down. One for things I got wrong professionally, which is longer than I would like. One that is simply called Ellen, which contains things I intend to say to my wife and have not, and things I have said and want to remember saying, and it is the only page in the entire vault I have ever considered deleting and I never will.’

Meera did not say anything for a moment.

‘I have the same page,’ she said. ‘It is not called that. It sits outside the clinical hierarchy entirely, because I made a rule at the beginning that my own material would never live inside the structure that holds patients. Different branch, different discipline of attention.’

‘What goes in it?’

‘What I cannot take to supervision because it is not about a patient.’ She turned the glass. ‘The evening after a difficult hour, when the difficulty is mine rather than clinical. The cases I still think about years later. There is an entry that has been open and edited for three years about a person I could not help and who I am fairly sure is no longer alive, and it is not a clinical record, it is an account. I do not know what it is for. I know that not writing it was worse.’

‘Does it help?’

‘It does something,’ Meera said. ‘Whether it helps is a question I would want more evidence for than I have. What I can say is that it stays put. It does not leak into the clinical notes, where it does not belong. It does not sit in my head competing for attention during a session. It has a location, and the location is not anybody else’s.’

They compared how the writing itself felt, which turned out to be the same complaint in both directions.

‘The editor does not get in the way, and that is the whole requirement,’ Felix said. ‘Headings when I want structure. Lists when a thought arrives as items rather than sentences. A callout block when I am unsure about something, which I use constantly, because an unresolved question needs to be visible rather than buried in a paragraph where I will read past it. Tables occasionally. And nothing whatsoever suggesting improvements.’

‘That last one.’

‘That last one is not a small thing.’ He leaned back. ‘I have used tools that were helpful, and I mean that word with the full weight of its condescension. They finished my sentences. They proposed alternatives. They highlighted a passage as unclear when the passage was unclear because the thought was unclear, which is a stage, not a defect. I do not want a collaborator at four in the morning. I want a surface.’

Meera laughed at that.

‘A surface,’ she repeated. ‘I am going to steal it. I have exactly one requirement of any tool I use for the personal branch, which is that it should not have a view.’

The conversation turned, as it does among people of a certain age with anything valuable, to what happens afterward.

‘I have thought about this considerably more than is healthy,’ Felix said. ‘Because a locked vault is a wonderful thing while you are alive and a genuine problem for the person who inherits it.’

‘What have you decided?’

‘That the folder goes to my daughter and the passwords go in a sealed envelope with the will, and the envelope contains instructions rather than only keys.’ He counted it out. ‘Which pages she should read. Which she should read only if she wants to. And one page she should delete without opening, which she will honour, because she is a better person than I am and always has been.’

‘Will she open it?’

‘I hope not and I have made peace with the possibility.’ He shrugged. ‘The point is that the arrangement is possible at all. The whole vault is a folder of files and a single file that reads them. There is no account. There is no company to notify, no subscription to keep alive, no support process for a bereaved person to negotiate while she is grieving. She receives a folder. That is the entire handover, and I cannot express how much comfort I take from its simplicity.’

Meera was quiet for a while.

‘I have not made that arrangement,’ she said. ‘I have obligations that outlive me, and records that have retention requirements, and I have been avoiding the question for about four years.’

‘You are forty-four.’

‘Clinicians die at forty-four,’ Meera said, without any drama at all. ‘And when they do, forty patients have a record somewhere that somebody must be able to transfer responsibly. I know what the professional answer is. What I have not resolved is the personal branch, which contains material about my own patients that is mine rather than theirs, and which nobody is entitled to and which I do not want destroyed unread either.’

‘Then that is your envelope,’ Felix said. ‘And I would encourage you to write it, on the grounds that a question you have been avoiding for four years is not a question, it is a resident.’

Meera looked at him for a moment and then laughed.

‘You supervise very well for a historian.’

‘I supervised nineteen doctoral students,’ Felix said. ‘Most of them needed exactly one sentence and four years of patience.’

What was actually agreed on, over two hours and a bad guitar

They stayed until the courtyard filled up and conversation stopped being possible, and before they left Meera said the thing that had been forming since the reading.

‘You skipped that paragraph today because seventy people were in the room.’

‘I did.’

‘And you will publish it.’

‘I will publish it,’ Felix said, ‘and that is not a contradiction, although it looks like one. There is an enormous difference between choosing to show something and being unable to prevent it being seen. The first is authorship. The second is exposure. I skipped it because I have not finished deciding, and I could only get far enough to have something to decide about because nobody was standing behind me while I wrote it.’

Meera picked up her bag.

‘That is your closing line,’ she said. ‘For the book. Not for today.’

‘I know,’ said Felix. ‘I have been carrying it around for about ninety minutes waiting for somewhere to put it.’

Privacy as a condition for thought

What the courtyard conversation kept circling, from two professions that share almost nothing operationally, is a claim that deserves stating plainly: privacy is not primarily about keeping information from people. It is about establishing the conditions under which certain kinds of thinking can occur at all.

The distinction matters because it explains why assurances do not work. A person told that their writing is confidential continues, quietly and automatically, to model a reader. The modelling is not a failure of trust and it is not solved by better trust. It is what human minds do with the possibility of an audience, and possibility is enough; the audience never has to arrive. The only thing that reliably stops the modelling is the removal of the mechanism. When the material never leaves the machine, when there is no server holding a copy, when the encryption key belongs to the writer and to nobody else, the calculation has nothing left to compute and eventually stops. What people notice at that point is not that they feel safer. It is that a background process they had never named has released the attention it was consuming.

The consequences show up as a change in what gets written rather than as a change in how it is stored. The regret goes in. The name goes in. The observation that would have been softened stays sharp. The clinician records her own reaction to an hour instead of omitting it and becoming, over years, slightly less able to examine her own practice. The memoirist writes the version that is worse prose and truer, which is the only version worth revising toward something better later. None of this is retrieved by a system that promises never to look. It is produced by a system that structurally cannot.

The second half of the claim concerns attention rather than secrecy, and it is the part people notice last. A tool that processes what you write, however benignly, teaches you what kind of writing it rewards. Fragments become untidy inputs. Half-formed contradictions become items to resolve. A line consisting of four words and a question mark becomes an anomaly rather than a seed. Anyone whose thinking arrives in that form, which is most people who think by writing, will gradually stop producing it, and will not notice the substitution, because what remains looks more competent. Notes that no system evaluates stay available to be bad, and being allowed to be bad is what lets a thought get written down before it has finished forming.

Both halves are architectural rather than aspirational. A single file that runs locally, connecting to a folder the writer owns through the File System Access API, with per-entry encryption so that opening one thing does not open everything, and a lock screen that covers the viewport in one action when somebody walks into the room. None of these are dramatic capabilities. Their combined effect is that a person can put a genuinely difficult sentence into a machine and know, without having to decide to believe anything, that it will still be theirs tomorrow.

That is a modest technical accomplishment and a large human one. The material that people carry unwritten for decades is not withheld out of secrecy. It is waiting for somewhere to be put. Most of it is not scandalous, most of it would bore a stranger, and most of it is the load-bearing content of a life: the decision that went the wrong way, the thing left unsaid to someone now dead, the reaction in the room that meant something. A tool that makes that material writable is not merely protecting information. It is producing thought that would otherwise not exist, and there is no version of that outcome that a privacy policy can deliver.

FAQs

Why does privacy affect what someone writes even when nobody will ever read it?

Because people model an audience automatically whenever one is possible, and possibility alone is sufficient to trigger it. The imagined reader does not have to be plausible, interested, or real. The effect operates below deliberate thought, which is why reassurance does not remove it: a writer can know with complete confidence that no human will ever open a document and still soften a verb, drop a name, or shorten a difficult passage into something diplomatic. What removes the effect is not stronger assurance but the absence of a mechanism. When there is genuinely no copy anywhere and no organization involved, the calculation has nothing left to run on and gradually stops. The effect is easy to test personally by writing the same difficult paragraph twice, once in a hosted document and once somewhere genuinely local, and comparing the two.

What is the practical difference between a privacy promise and a privacy architecture?

A promise is a statement of intention by an organization, and organizations change. They get acquired, restructured, subpoenaed, or simply revise their terms. A thoughtful person continues to evaluate a promise indefinitely, allocating a small but permanent portion of attention to the possibility that circumstances change. An architecture removes the question. If software makes no network requests, holds no server component, and writes only to a folder on the user’s own machine under a key the user controls, then the guarantee does not depend on anyone continuing to behave well. This distinction is why architectural privacy produces a psychological effect that policy-based privacy does not. Put simply, a promise asks to be trusted and an architecture asks to be inspected, and only one of those questions can be settled once and left settled.

Why does per-entry encryption feel different from encrypting an entire vault?

Vault-level encryption answers the question of whether material is protected. Per-entry encryption changes what is present while you work. With a single door, opening it to write about one thing makes everything you have ever written available in the same session. With per-entry passwords, unlocking a specific entry leaves everything else closed, so the difficult material is not merely protected but genuinely absent from the working context. Users consistently describe this as changing how the work feels rather than how secure it is, and for writing that involves painful or sensitive material the difference is substantial and immediate. It also reduces the consequences of walking away from a desk mid-session, since whatever remains open is limited to the one thing being worked on rather than everything ever written.

What does the lock screen actually do?

It covers the entire viewport with a blur overlay and blocks all interface interaction, including pointer events and content selection, until the session is authenticated again. Nothing behind it can be read, clicked, or copied. The important properties in practice are that it engages in a single action and that it is faster than looking up from the screen, since any protective measure that requires deliberation will not be used at the speed real life demands. It exists for the ordinary case of someone entering the room, not for a dramatic threat. It is worth practising until the gesture is automatic, because a measure that is only used after a conscious risk assessment will always be slower than the situation it exists for.

Why would someone lock the screen from people they trust completely?

Because visibility and reading are different problems. A screen with words on it, in a room containing another person, is effectively a published document, regardless of whether anyone chooses to look. The discomfort is usually not about secrecy but about state: the paragraph is unfinished, unedited, and not in a condition its author would choose to show anyone. Knowing that this can happen changes how a person writes for the rest of the working session. Locking the screen removes the possibility, which removes the awareness, which is the actual objective. The same logic explains why writers lock the screen for delivery drivers, family members walking past, and video calls, none of which involve anyone with any interest in reading the text.

Is privacy genuinely a precondition for honest writing, or just a preference?

Clinically, safety is understood as a precondition rather than a courtesy. People give a well-rehearsed account of their lives until the conditions establish that this setting is different, and that account contains almost nothing they have not already resolved. The same mechanism appears in solitary writing. A memoir written for an imagined reader omits precisely the material that would make it worth reading, and a clinical note written for a potential reviewer omits precisely the reasoning that makes it useful later. In both cases the omission is invisible, because it is performed by the only person positioned to notice. The strongest evidence is what happens afterward: people who gain genuine privacy usually report writing material they had been carrying for years rather than material they invented once the option appeared.

How do clinical notes change when the writer knows they are private?

They typically become messier, longer, more provisional, and considerably more useful. Notes written with a potential reviewer in mind tend to be technically complete and clinically thin: they record what was discussed and omit why the clinician moved in a particular direction. The absence goes unnoticed until the author returns to their own note months later and finds a competent summary that answers none of their questions. Private notes retain hypotheses, uncertainty, and reconsideration of earlier judgments, which is what clinical thinking looks like when it has not been edited for an audience. The change is easiest to detect by rereading old notes and asking whether they answer the questions their author actually has now, rather than whether they look complete.

How can different kinds of content be kept separate within one patient record?

Sections within a single entry allow distinct purposes to remain adjacent without merging. A common arrangement uses one entry per patient with sections per session date, and within each session further sections separating the factual record, the clinical reasoning, the clinician’s own observed reactions, and purely administrative matters such as scheduling. Each section has its own body text and can carry its own attachments. Keeping these apart matters because merging a record with an interpretation produces something that reads as confident fact, and separating them preserves the distinction that makes the note trustworthy later. Because each section carries its own attachments, supporting documents also sit with the part of the record they belong to instead of accumulating loosely at the level of the entry.

Why record a clinician’s own emotional reactions at all?

Because those reactions are clinical information rather than sentiment. A practitioner who feels nothing during a session is not being professional but absent, and what they notice in themselves is frequently data about what is occurring in the room. The material is most valuable when recorded raw and unprocessed, in half-sentences, because interpreting it at the time usually produces the wrong interpretation. Taken to supervision weeks later in its unedited form, it can be examined properly. This is precisely the category of writing that disappears first in any system where an untrained reader might encounter it. Keeping them in a clearly labelled section rather than woven into the narrative also protects the record itself, since a reaction embedded in a description can later be mistaken for an observation.

What is session password caching and why does it matter?

It holds an entered password for the duration of a working session so that a clinician or writer moving through several entries is not re-entering it repeatedly. This is a usability decision with a security purpose: any protection that becomes irritating at the frequency it is actually encountered will eventually be circumvented by the person it is meant to protect. Designs that are tolerable in real use are followed, and designs that are not get routed around, which produces worse outcomes than a slightly less strict scheme that people actually maintain. The general principle is that security which is tolerable at the frequency it is actually encountered gets maintained, while a stricter scheme that irritates people gets quietly defeated by them.

What is the random note spotlight and why does it matter emotionally?

It is a sidebar widget that surfaces one entry chosen at random from the entire library, refreshing hourly with an indicator when the selection changes. Its value is that it makes no attempt to be intelligent. A system selecting by relevance would surface what a user already knows they care about, which is a small and heavily curated subset of what they have written. Random selection places forgotten material in front of someone who is holding something else in mind, and the collision between the two frequently produces the connection that deliberate searching cannot reach. Its usefulness depends entirely on engaging with whatever it offers, including the many unremarkable items, since the significant one is not distinguishable from its title in advance.

How does random surfacing relate to involuntary memory?

The memories a person can summon deliberately are a rewritten and narrow subset, while the ones carrying real force tend to arrive sideways, triggered by something that was not being used as a trigger. A widget that presents an unrequested entry creates exactly that condition artificially. It does not know what it is doing, which is why it works. Users who build a short daily ritual around reading whatever appears report that most days produce nothing and that a small number of days produce material they could never have located by searching, because they had forgotten it existed. The experience is characteristically one of recognition rather than of learning, which is a reasonable indication that the connection was already present and simply had never been occasioned.

What should be done when the spotlight surfaces something important?

It should be captured immediately, because random selection carries no guarantee of returning to the same item and intention to remember later is unreliable. Marking the entry as a favorite places it in a dedicated sidebar panel where it can be found deliberately afterward. Over months the starred set becomes a record of which material actually carried energy, which for a long writing project is close to a list of chapters and for reflective work is a map of the themes that keep recurring without having been chosen. Writing two or three lines about why it mattered at the moment of noticing is equally valuable, because the reason is usually clearer immediately than it will be when the entry resurfaces later.

What does the Recently Read page reveal?

It shows the entries visited most recently, which during an exploratory session becomes a record of the path taken rather than the destinations reached. Reviewing that trail at the end of a working session frequently reveals that several apparently unconnected items shared a theme the reader had been inside without noticing. This functions much the way an outside observer does when they point out that four separate descriptions were all descriptions of the same thing. The trail is information about association rather than retrieval, and it is often more useful than any individual entry on it. Checking it takes seconds and costs nothing, which is why it is worth doing at the end of any session that ranged widely rather than only when a session felt significant.

Why keep fragmentary or poorly written notes?

Because a fragment is the only available form for a thought that has not finished arriving. A line consisting of a name and a question mark, or two sentences that contradict each other, is not a failed note; it is a seed that may germinate when something else lands beside it years later. Systems that evaluate or process writing quietly teach their users which kinds of writing they reward, and material that would be treated as noise gradually stops being produced. Notes that nothing analyzes remain free to be bad, which is what allows them to be written at all. The practical test is whether a note would have been written at all under a stricter standard; if the honest answer is no, the standard is removing material rather than improving it.

Does having content analyzed automatically affect what gets written?

Yes, and usually without the writer noticing. Once a system summarizes, categorizes, or extracts insights from writing, incomplete items become candidates for cleanup and unresolved contradictions become problems to fix. The pressure is gentle and constant rather than explicit. Over time people write more finished, more competent notes and fewer of the provisional ones, and the substitution is invisible because the remaining material looks better. The absence of any content processing is therefore not a missing capability but a deliberate condition under which exploratory thinking survives. The shift is gradual and invisible from the inside, which is why the useful comparison is between what someone writes now and what they wrote when they first started keeping notes at all. Most people find the earlier material rougher, stranger, and considerably more generative.

How does offline-first operation function as a privacy guarantee?

Because it removes the transmission rather than securing it. Running as a single HTML file that connects through the File System Access API to a folder on the user’s own machine means there is no server component at all, so there is nothing for material to be sent to. This is a stronger statement than encrypted transmission, which protects content in transit to a destination that still receives it. Users can verify the absence of network activity independently, which is what converts the claim from something believed into something checked. It also means the guarantee does not weaken over time, since there is no service whose terms might change, no account that could be migrated, and no infrastructure decision made by anyone else.

Is this level of privacy only relevant to regulated professions?

Regulated professions make the requirement explicit, but the underlying effect applies to anyone writing anything they would not want to see quoted. Memoirists, journal keepers, people working through a difficult period, anyone drafting a letter they may never send, and anyone recording observations about family, colleagues, or their own conduct all encounter the same mechanism. Compliance obligations simply force some professionals to think about it deliberately. The psychological benefit exists regardless of whether any legal framework applies to the writing. Anyone who has kept a journal and later found a passage where they were clearly writing for a future reader has encountered the effect directly, whether or not they named it at the time. The professions simply make the stakes explicit enough that the problem gets addressed deliberately.

How does a physical drawer compare to a private digital vault?

The older model made privacy a property of objects rather than a feature to be arranged: a letter in a drawer required someone to enter a house and open furniture. Digital tools reversed that default largely as a side effect of adopting capabilities that were genuinely better, and few people consented to the reversal explicitly. A locally stored, locally encrypted vault restores the older default while retaining the capability that made the trade attractive in the first place, which is that decades of material can be searched in seconds rather than being effectively unreachable. The comparison is not nostalgic, since the drawer had a genuine and severe weakness: material in it was effectively unreachable, and decades of accumulation could not be searched at all.

Do people raised entirely with digital tools experience this differently?

Often they report never having had the older experience at all, and therefore never having felt its absence. Having adapted efficiently to the assumption that anything digital exists in copies elsewhere, they self-censor without noticing, in the way a persistent background noise stops being audible. The disorientation, when it comes, tends not to be about gaining privacy but about discovering retrospectively how much effort had been going into managing its absence. That version of the observation is arguably the more persuasive one, since it does not depend on nostalgia for anything. The practical implication is that the benefit is not limited to people who remember an earlier arrangement, and may in fact be larger for those who never had one to compare against.

Does choosing not to share something contradict writing it privately?

No, and conflating the two is a common error. Choosing what to show is authorship. Being unable to prevent something being seen is exposure. A writer who omits a passage from a public reading has exercised a judgment about timing and readiness, and that judgment is only available if the passage exists in the first place. Privacy does not remove material from circulation; it makes material exist so that a decision about circulation becomes possible. Much of what eventually gets published could only have been written under conditions where publication was not assumed. Many published works exist only because their difficult passages were first written under conditions where publication was not assumed, and the decision to include them came much later.

How should someone begin writing genuinely private material?

Usually by lowering the stakes of the first attempt. Creating an entry that will never be shown to anyone, writing badly on purpose, and resisting the urge to shape it into something presentable removes most of the initial resistance. Establishing a small ritual helps, such as unlocking a specific entry deliberately at the start of a session, since the act of unlocking marks a transition into a different mode of attention. The change in the writing itself is usually noticeable within a few sessions and is generally described as a loss of a performance the writer had not realised they were giving. Setting a low bar helps considerably: a single entry, no intended reader, no requirement that it be finished, and no expectation that anything useful will result from the first attempt.

Does privacy make notes less useful to share later?

Generally the opposite. Material written honestly can always be edited toward something suitable for an audience, and the editing is straightforward because the substance is present. Material written for an imagined audience from the start cannot be recovered, because what was omitted was never recorded and usually cannot be reconstructed years later. Writers working on anything intended for eventual publication therefore benefit twice: the private draft contains the difficult content that gives the finished work its value, and the decision about what to include remains theirs rather than being made in advance by anxiety. Editing honest material down for an audience is ordinary work, whereas reconstructing what was omitted years ago is usually impossible, since the omission left no trace to recover.

What is the strongest argument for architectural privacy over trusted providers?

That it requires nothing to be assumed. A trusted provider may be entirely honest, competent, and well intentioned, and the arrangement still depends on that continuing to be true through changes of ownership, jurisdiction, and policy. Architecture that involves no server, no account, and no transmission does not depend on anyone’s continued good behaviour, which means the user is not extending trust at all. The practical consequence is not merely reduced risk but reduced cognitive load, since a guarantee that cannot lapse is a guarantee nobody has to keep monitoring. It is also the argument that survives the most hostile examination, because it does not require the provider to be untrustworthy for the reasoning to hold.

Should personal writing live in the same structure as professional records?

Keeping them in separate branches of the page hierarchy is a widely used discipline, particularly for clinicians, and the reason is about attention rather than about storage. Material a professional writes about their own reactions to their work is theirs, while the record belongs to the client or patient, and mixing them risks the personal content drifting into a document that other people may legitimately read. A separate top-level branch keeps both inside one searchable vault while making the distinction structural rather than a matter of remembering. It also makes different handling rules possible, since the two categories have different retention obligations and different inheritance questions. Establishing the separation at the start is far easier than introducing it later, once material has already accumulated in a single undifferentiated branch.

What kinds of writing end up in a personal branch?

Typically the material that has nowhere else to go: reflections after a difficult day, accounts of situations that will never be resolved, things a person intends to say to someone and has not, grievances being worked through, and professional mistakes worth remembering. None of it is scandalous and most of it would be uninteresting to a stranger, which is exactly why it is the material people carry unwritten for decades. Users frequently report that giving it a location removes it from competing for attention elsewhere, and that the benefit is noticeable even when the writing itself never resolves anything. It is also where professional mistakes worth remembering tend to accumulate, which over time makes the branch one of the more useful things a practitioner owns.

What should a writing editor do and not do for reflective work?

It should provide structure without opinion. Headings, ordered and unordered lists, tables, links, inline images, and callout blocks for marking unresolved questions cover essentially every structural need in long-form personal writing, and callouts in particular earn their place by keeping uncertainty visible rather than buried inside a paragraph. What matters as much is the absence of suggestions, completions, and quality judgments. A passage that reads as unclear is often unclear because the thought is unfinished, which is a stage rather than a defect, and a tool that flags it is interrupting the process it appears to be assisting. The reasonable summary is that the tool should be a surface rather than a collaborator, since a collaborator has views and a surface does not.

How does a private vault get passed on after death?

The practical answer is unusually simple because the entire system is a folder of files plus a single file that reads them. There is no account to transfer, no subscription to maintain, no company to notify, and no support process for a grieving family member to negotiate. The folder can be inherited directly and opened on any machine. What remains is the human part, which is deciding what the recipient should be told: which passwords they receive, which material is intended for them, and which is not. Writing those instructions alongside a will is a small task that turns an unsolvable problem into an ordinary one. Instructions matter as much as keys: which material is intended for the recipient, which is optional, and which should not be opened at all.

What about professional records with retention obligations?

Those need a separate arrangement from personal material, since obligations to clients or patients outlive the practitioner and require responsible transfer rather than inheritance. Keeping the two categories in distinct branches of the hierarchy from the beginning makes this considerably easier, because the professional branch can be handed to whoever is designated to assume responsibility while the personal branch follows different instructions entirely. Practitioners frequently postpone this planning for years, and the useful observation is that a question avoided for that long has stopped being a question and become a permanent background cost. Naming a specific person who will assume responsibility, and telling them where the material is, converts an abstract obligation into an arrangement that can actually be executed.

Does writing something down actually change how a person carries it?

The evidence for specific outcomes is mixed and worth treating carefully, but the consistent report from people who keep this kind of material is that recording it changes its position rather than resolving it. Something written has a location, and material with a location competes less for attention than material being held. Practitioners describe lists of grievances shortening over years, and writers describe finding that a regret examined in writing becomes examinable rather than merely recurrent. Whether that constitutes help is a reasonable question; that it differs from not writing it is not seriously disputed by anyone who has tried both. What is clear is that the material exists either way, and that the version held silently is the version that keeps demanding attention at inconvenient hours.

How does someone verify that software makes no network requests?

Directly, using the tools already available in any browser. The network panel of the developer tools records every request a page makes, so opening it and working normally for a period shows whether anything is transmitted. Operating system firewalls and network monitoring utilities provide a second, independent check at a lower level. This is not a specialist procedure and takes a few minutes. The significance is that the claim becomes something confirmed by observation rather than something accepted on the strength of documentation, which is precisely the distinction that produces the psychological effect users report. Repeating the check occasionally after any update is sensible practice, and takes no longer than the first time it was performed.

Why does a single-file design matter for privacy specifically?

Because it dramatically reduces what has to be understood in order to trust it. A conventional application spans installers, background services, update mechanisms, and components that may reach the network for reasons unrelated to the user’s data. A single HTML file opened in a browser has a much smaller surface to reason about, and its behaviour can be inspected. Combined with connecting to a local folder chosen by the user, the result is a system where the question of where the material lives has a short and checkable answer, which is what allows the background monitoring to stop. It also makes the system durable, since a file that can be opened by a browser today has an unusually good chance of remaining openable long after specific applications have disappeared.

Is there a risk in keeping deeply personal writing at all?

There is a real question, and it deserves an honest answer rather than reassurance. Material that would be painful if read by the wrong person exists whether or not it is written down; writing it changes where it exists and who could encounter it. The mitigations are practical: per-entry encryption so that sensitive material is not opened alongside routine work, deliberate decisions about what happens to the vault later, and explicit instructions for whoever inherits it. What most people conclude, having weighed it, is that the cost of never writing the material was higher and had been paid continuously for years. The decision is genuinely personal, and the honest framing is a comparison of two costs rather than the elimination of one of them.

Does this approach suit people who are not writers by inclination?

The barrier is usually lower than expected, because the writing in question is not performance. Fragments, lists, half-sentences, and single lines all count, and the material that produces benefit is rarely well composed. People who describe themselves as bad at writing frequently produce useful personal records precisely because they do not attempt to make them good. The practical starting point is a single entry with no intended reader and no requirement that it be finished, which removes the standard most people are unconsciously measuring themselves against before they have written anything at all. Lists, single lines, and unfinished sentences all count fully, and the record’s value comes from its existence rather than from its quality as prose.

Why does unlocking an entry function as a transition rather than an obstacle?

Because attention does not switch instantly, and a marked interval gives the switch somewhere to happen. Clinical settings construct thresholds deliberately using waiting rooms, corridors, and doors that take a moment to close, none of which serve a functional purpose beyond marking a change of context. Entering a password specific to one entry and waiting briefly while it opens performs the same role. The interval does not need to be long; it needs to be deliberate. Users commonly report writing differently in the minutes after a marked opening than they would if the material had simply been sitting available. This also explains why users rarely describe the step as friction once it becomes routine, despite it being, in purely mechanical terms, an extra action.

What does it mean that locking the screen becomes automatic?

It means the attention previously spent monitoring the room has been released. While a person is still deciding whether to lock, they are actively tracking who might approach and what is currently visible, which is a low-level vigilance loop running continuously in the background. Once the gesture happens without deliberation, that loop stops, because the response is reliably handled. Much of what people describe as feeling safe is precisely this: not the absence of risk, but the point at which something else dependably covers the thing they had been watching for. Reaching that point takes surprisingly little time, usually a few weeks, after which the gesture stops registering as a decision at all.

How does an offline-first tool behave differently in daily use?

The most noticeable difference is the absence of events. There is no waiting on startup, no connection indicator to check, no notice explaining that changes will be synchronised later, and no degraded mode. Opening the file and granting access to a folder is the complete startup sequence, and it behaves identically during a power flicker in a rural house and in a venue where the network has collapsed under load. Users generally stop noticing this within days, which is the intended outcome, since the value lies in an entire category of interruption never occurring. The clearest demonstration is using it somewhere the network has genuinely failed, where nothing about the experience changes and no message appears to acknowledge that anything has.

How is a local vault backed up?

By copying a folder, using whatever method already copies folders on the user’s system. Because the vault is files on disk rather than data inside a service, backup is not a feature to be configured but a consequence of the storage model, and it works with external drives, existing backup software, or a manual copy to a second location. This also means the backup is independently usable: the copied folder opened with the same single file produces a working vault, with no import step and no dependence on any organization continuing to operate. Keeping at least one copy somewhere physically separate is worth the small effort, since local storage protects against services and not against fire or theft.

Does an informal network of users matter for a tool like this?

It matters more than expected for tools that are deliberately quiet. Software with no server component and no accounts produces no community by default, so the people using it seriously tend to find each other through introductions rather than through platforms. What gets exchanged in those conversations is usually not features but practices: how someone structures a hierarchy, which habits survived contact with a real workload, what they wish they had done at the start. Those practices are the part that is hard to derive alone and easy to transfer in an hour of conversation. Conversations of this kind also tend to correct assumptions early, which saves considerably more time than any amount of independent experimentation.

What is the single most useful thing to change first?

For most people it is to stop writing for an absent reader, and the practical route is to create material that could not be shown to anyone by construction rather than by intention. Making a specific entry, encrypting it separately, and deliberately writing something in it that would be uncomfortable to see quoted tends to produce the shift faster than any amount of resolve. The change is usually noticeable within a handful of sessions, and it is generally described not as a new capability but as the ending of a performance the writer had not known they were giving. It is worth writing that first entry badly and on purpose, since attempting to write it well reintroduces exactly the audience the exercise is designed to remove.