How we protect your data

When you mark a field sensitive (or we detect one — a password, card, government ID), it's encrypted on your device, in your browser, before it ever reaches our servers. The key is derived from a passphrase only you know. We never receive your passphrase, the key, or the plaintext — only an opaque encrypted blob we cannot open.

• This is called zero-knowledge encryption — the same model 1Password and Bitwarden use.
• We literally cannot read your sensitive fields. Not our staff, not our database, not anyone who might breach it.
• The trade-off: if you lose both your passphrase and your recovery key, even we can't recover that data. That's the price of real privacy.

Every place your context could leave your control — the AI/Pollen feed, your public profile, the browser extension, connected integrations — passes through a single filter that strips out anything marked sensitive. A sensitive field is never sent to an AI, never shown on a public page, never read by an integration. Even if something slipped through, it would be encrypted gibberish, not your actual data.

Import a resume or connect an account, and we scan what comes in — instantly for common patterns, and with a deeper AI pass for harder-to-spot IDs from any country. Anything that looks sensitive is flagged and defaulted to encrypted, so a phone number or passport buried in a document doesn't accidentally end up public. You always review and approve — nothing is shared or hidden without your say-so.

Everything else — your role, skills, preferences — is context you want AI to read, so it's stored so we can serve it to the tools and people you choose. You control the visibility of every strand (private, your grove, a private link, or public), and you can change or delete any of it at any time. Only what you explicitly make public is ever public.

• All traffic is encrypted in transit (HTTPS/TLS).
• Your database rows are protected by row-level security — one user can never read another's data.
• Integration access tokens are encrypted at rest with a separate key.
• Per-device API keys can be revoked individually, and you can sign out at any time.

Context you choose to share with AI can't also be encrypted so that nothing can read it — that's a contradiction. So your non-sensitive, shareable fields are stored so the AIs and links you authorize can read them (protected by access controls and encryption in transit), while your sensitive fields get the full zero-knowledge vault treatment above. We'd rather tell you exactly where the line is than pretend everything is magically encrypted.

Security question, or think you've found an issue? Email hi@masst.ai. See also our Privacy Policy.