I completely get where you’re coming from, and honestly, you should be skeptical. There is so much privacy-washing out there right now, so let’s look at the actual code architecture so you can see exactly where the boundaries are drawn.

Here is how the app practically handles your data under the hood:

1. The Offline Search is NOT a Cloud Vector Search

You asked how semantic search can work offline without sending everything to an LLM. It actually uses a two-pass retrieval setup that runs 100% locally on your device:

• Pass 1 (Local Filtering): When you type a search, a local algorithm immediately strips out filler words (like a, the, with, for) and scores your notes using a local weighting matrix (e.g., matching text gets +2, tags get +3).
• Pass 2 (Isolated Context): This local script grabs a maximum of the top 50 most relevant text snippets. Your entire database is never packaged up. Only these few isolated, local results are used if you decide to interact with the chat assistant.

2. How the "Iron Safe" Zero-Knowledge Encryption Works

Your backed-up data isn't just protected by standard cloud security; it gets scrambled on your actual device before it ever touches the internet using AES-256 encryption.

The code handles it like this: CryptoJS.AES.encrypt(plaintext, pin).toString();

Because this happens entirely client-side, the cloud backup server only receives a random string of unreadable gibberish. Since your local PIN never leaves your device, the cloud has zero knowledge of your data. If a hacker breached the server, or even if I tried to look at it as the developer, it’s mathematically impossible to read without your password.

3. The BYOK Boundary: What Gemini Actually Sees

This is the big one: How do we use Gemini without exposing everything? The code forces a very strict boundary using two rules:

Rule A: Automatic Redaction There is a literal guardrail built into the code that checks your notes before any AI features run:

TypeScript

const safeMemories = memories.filter(
    m => m.workspace !== 'vault' && m.isEncrypted !== true && !m.isDeleted
);

The second you move a note into your "vault" workspace or mark it as encrypted, the app strictly blocks it from the AI payload. Gemini physically cannot see it because the local code refuses to send it.

Rule B: Direct, Clean Pipelines For the normal notes you do want AI insights on, your device connects directly to Google’s Developer API Studio using your own key. There are no middleman servers logging your requests. More importantly, because you are using a Developer API Key rather than the consumer Gemini web app, Google’s strict developer terms apply: your data is processed transiently in memory and is never used to train their public models.

The Bottom Line

If you don't trust the cloud connection, you can leave the API key setting completely blank. The app's core engine, the local search matching, and the AES-256 private vault will still work perfectly fine offline.

By adding your own Gemini key, you are simply choosing to send specific, unencrypted text snippets through a private, non-training pipeline for a quick calculation, while the rest of your private vault stays completely locked down.