How Legate Studio Protects Your Knowledge
A straightforward account of how your data is stored, who can access it, how you authenticate, and what analytics we run. No vague promises — concrete architecture.
Per-user databases, not shared tables
Your notes are stored as markdown in your own private GitHub repository, and indexed in a per-user SQLite database file on a persistent Fly.io volume. That per-user database — holding your notes' metadata, categories, embeddings, and graph data — is a separate file per account; your knowledge is not stored in a table shared with other users.
This is an intentional architectural decision. Shared multi-tenant databases are efficient for the platform but create a class of risk: a query bug, a misconfigured permission, or an injection vulnerability in one account can affect others. Keeping each user's knowledge in its own database file removes that class of problem. Just as important, the database you read and write is chosen from your authenticated session identity — never from an ID supplied in the request — so one account cannot address another account's data.
A shared database holds account and operational records: your GitHub login, subscription status, profile settings, the transcript-processing job queue, usage metering, and an audit log. These are scoped to your user ID. Your knowledge content lives in your per-user database and your GitHub repository.
Every account has its own database file. Your notes never share a table with another user's data.
Databases are stored on Fly.io's persistent block storage — data survives app restarts and deploys.
You can download your database file directly from account settings. SQLite is a standard format — use any SQLite browser to inspect it.
GitHub OAuth — no passwords to breach
Legate Studio uses GitHub for authentication. When you log in, you're redirected to GitHub, authenticate there, and GitHub tells us who you are. We never see your GitHub password — it never touches our servers.
Because your notes are stored as markdown in a GitHub repository, Legate Studio uses a GitHub App that you install and grant access to only the specific repositories you choose — your Library repo, plus any repositories you explicitly tag for the Chords workflow. It cannot see your other repositories. Within the repos you select, the App reads and writes your notes on your behalf. You can review or revoke this access from your GitHub settings at any time.
Your login is kept in a session cookie that is cryptographically signed with a secret only our server holds, so it cannot be forged or tampered with. The cookie is marked HTTP-only (JavaScript cannot read it) and, in production, Secure (sent only over HTTPS). Sensitive tokens are never placed in the cookie — they are encrypted and stored server-side. Sessions expire and are cleared on sign-out.
No passwords stored on our servers. Authentication happens at GitHub — your password never touches our infrastructure.
The GitHub App can access only the repositories you select when you install it — your Library and any repos you tag. Never your other repositories.
Login cookies are cryptographically signed, HTTP-only, and Secure in production. Sensitive tokens are encrypted and stored server-side, never in the cookie.
What we do and don't do with your notes
Your notes are processed through AI models to generate transcriptions, categorizations, and embeddings. That processing requires sending content to an AI provider — Anthropic, OpenAI, or Google Gemini — either under your own key (BYOK) or under our managed account.
We do not use your notes to train models. We do not retain copies of your content beyond what's needed to run the app. We do not read your notes for any purpose other than running the AI pipeline on your behalf.
On the BYOK plan, your content goes directly from Legate to your chosen provider under your own API key — under that provider's terms of service, not ours. On the Managed plan, it goes to the provider under our account. We select providers that offer data processing agreements and commit to not training on API inputs by default.
What we store
- Your GitHub profile information (username, name, avatar URL) — for your account
- Your subscription status and billing ID — for payments via Stripe
- Your notes, categories, embeddings, and graph data — in your per-user database and your GitHub repository
- Your profile settings (display name, bio, accent color) — for your public profile
- Any AI provider API keys you add — encrypted at rest with a per-user key (see below)
How we handle your API keys
If you bring your own API key, it is encrypted before it is written to the database, using a key derived per-user from a master secret. It is decrypted only in memory, at the moment we make a request to your provider on your behalf, and never logged or exposed. If you remove a key, the stored ciphertext is deleted.
What we don't store
- Your GitHub password (we never see it)
- Your credit card details (handled entirely by Stripe)
- Audio files after transcription is complete (audio is processed and discarded)
Privacy-first analytics via Plausible
We use Plausible Analytics to understand how the product is used. Plausible is an EU-based, open-source analytics provider that does not use cookies, does not build user profiles, and does not track you across sites.
Plausible counts pageviews and events (button clicks, feature usage) as aggregate numbers — not tied to individual users. We see "100 people visited /features" — not "user X visited /features at 2pm." No IP addresses are stored. No fingerprinting is done.
We do not use Google Analytics, Facebook Pixel, or any other tracking technology. Plausible is the only analytics tool on Legate Studio.
Security questions or concerns
If you discover a security issue, have a question about our data handling, or need to report something, please reach out at hello@legate.studio. We take security reports seriously and will respond promptly.
For general privacy questions, see our Privacy Policy.