What "private by default" actually means

"Private by default" is on almost every product page now. Most of the time it means one specific thing: the company still collects your data, but encrypts it on the way. That's not nothing. It's also not what most people hear when they read the words.

There's a stronger version of the promise, and it's worth learning to spot. The sensitive thing should never leave your device in the first place. And where it does have to leave, you should be told exactly what, exactly when, and to whom. This is about the gap between those two claims. We'll use Daysift as the worked example, including the two places our own protection stops, because a privacy claim you can't poke at isn't worth much.

Two things people mean by "private"

Encryption-in-transit and data-never-collected sound similar. They are not.

Think of a letter. Sealing it in a tamper-proof envelope protects it from everyone between you and the recipient. It does nothing about the recipient reading it, or keeping a copy, or being compelled to hand it over later. The stronger version of privacy isn't a better envelope. It's not mailing the letter at all.

Encrypting data you collect protects it from outsiders: a breach, a network snoop. It doesn't protect it from the company that holds the keys, or from whoever that company answers to. When data is never collected, none of those questions apply, because there's nothing to read, sell, leak, or subpoena. That's the bar worth measuring against.

Where your browsing history actually lives

Your browsing history is a record of your thinking. The contract you half-read at 11pm, the clinic you looked up, the job posting, the three articles about a decision you haven't told anyone about yet. Most tools treat that record as theirs to sync.

Daysift keeps it on your machine. Every page worth remembering is indexed into a local database in your browser. We don't sync it, upload it, or keep a copy on a server somewhere. When you press ⌘J and search, the matching runs against that local index. The words you type never reach us.

Here's the scoped version of the claim, which is the only kind worth making: in a worst case where our servers were breached tomorrow, there would be no browsing history to find, because we never had it. That's not a promise to guard your data well. It's the absence of the data to guard.

The difference shows up when a claim gets tested. A company that encrypts the history it collects can still be handed a legal request for it and has to comply, because the data exists and is reachable. The same copy can be read in a breach, since the company holds the keys. A company that never collected your history has nothing to produce and nothing to lose, because the record only ever lived on your machine. Same word on the label. Very different outcome under pressure.

Where the protection stops

This is the part most product pages skip, so we'll be plain about it. There are two places where something does leave your device. You should know both.

AI. When you ask the AI a question or summarise a page, the text needed to answer has to be processed somewhere, and that somewhere isn't your laptop. We send it to Proton Lumo, an AI service based in Europe, with Groq as a fallback if Proton is down. Be precise about what that protection is: over the Lumo API, it's HTTPS/TLS in transit plus Proton's no-logs, no-training policy. It is not end-to-end or zero-access encrypted (those are properties of the Lumo app, not the API), and the text passes through our own proxy on the way. Proton doesn't train on it or keep it after answering, and we don't store it. But it does leave your device, and only when you trigger it. That's the one part of Daysift that isn't local, and we'd rather say so than let the word "private" imply otherwise. If that tradeoff isn't one you want, the AI is optional: skip it, and Daysift stays fully local, one query at a time. We wrote up the whole change here.

Usage stats. We also collect a little information about how the app itself is used: how often search or AI runs, when someone reaches a free-plan limit. These are counts of actions, not content. In practice that's a short event name, your plan tier, the app version, and a random ID that lives on your device and resets whenever you want. We don't collect what you search for, which sites you visit, your page text, or your notes. It's on by default, and it's one click to turn off in Settings. We added it so we can see which features earn their place and which don't. We'd rather tell you that in a blog post than bury it in a policy you'll never open.

Naming where the line is doesn't weaken the claim. It's the thing that makes the rest of it believable.

How to tell a real claim from a slogan

You don't need to read source code to judge a privacy promise. Three questions do most of the work.

What do you collect, and what do you not? A real answer names specifics on both sides. "We take your privacy seriously" names nothing. "Your history stays on your device; we don't collect what you search for" can be checked, and held against the company if it's false.

Where does the protection stop? Everything has a boundary. If a product implies nothing ever leaves, be more skeptical, not less. It usually means the boundary is there and unspoken. The honest version tells you where the edge is before you find it yourself.

Can you verify it? Local-first has a nice property here: you can see it. Open your browser's developer tools and your Daysift history is sitting right there on your machine. You can export it. Uninstalling deletes it. Nothing about that depends on trusting us. It depends on where the data physically is.

A privacy claim you can't locate a boundary on is marketing. One you can check is a feature.

The short version

"Private by default" shouldn't be a mood. It's a set of specific, checkable boundaries: keep the sensitive thing on the device, send only what the person actually asks for, and say plainly where the line is. Encryption matters, but it's the weaker promise. Not collecting the data in the first place is the stronger one.

That's the standard we try to hold ourselves to: history that stays local, AI that runs only when you ask it, usage stats you can switch off, and two honest footnotes about where our own line stops. Next time a product tells you it's private by default, ask it the three questions. The good ones have answers ready.