A safe-house for the system

Our System Sanctuary is built to be a digital safe-house for plural minds. Not a clinical tool. Not a tracker. A place to live. The features here — the front log, identity story, internal letters, journals, whiteboards, alters — are scaffolding. You decide how they’re used, and you can hide the ones that don’t serve you. The defaults are calm and small on purpose.

We took the word sanctuary seriously when we named this. A sanctuary is somewhere you go to be safe, to rest, to remember who you are without having to prove it to anyone. That’s the bar.

Plurality looks different in every system. Some systems work toward harmony — clearer communication, more co-conscious time, easier handovers between alters. Some systems work toward fusion. Some systems live comfortably as many for their whole lives and never aim for either. All of these are valid.

We don’t ask you to pick a goal, and we don’t push you toward one. We aren’t in the business of telling a system what shape it should be. The app supports the work the system has chosen for itself.

We chose server-side recovery over Zero-Knowledge encryption because, in this community, a forgotten password shouldn’t mean a lost life-history.

When we designed how data is protected, we faced a real choice. We could offer end-to-end (zero-knowledge) encryption — a technical standard where not even the developer could read your data. The cost: if you lose your password and your recovery phrase, your data is gone forever. No support, no recovery, nothing.

For most apps, that trade-off is fine. For a sanctuary where dissociative amnesia is part of daily life — where forgetting things isn’t a quirk, it’s a reality — that trade-off is not okay. A switched-out alter, a blackout day, a lost recovery phrase tucked into a notebook nobody currently fronting remembers writing — any of these can mean a zero-knowledge system locks the system out of its own life-history forever. We weren’t willing to build a sanctuary with that trapdoor in the floor.

So we chose server-side encryption with email-based recovery. Your data is encrypted at rest and in transit, gated by row-level security so other users on the platform cannot reach it. The developer can technically reach it, in the same way every web-app developer can reach their own database — and we’ve written exactly when, why, and how on our Trust & Privacy page.

This was a deliberate choice, not a limitation we hid behind. If the community ever asks for zero-knowledge as an opt-in tier, we’ll revisit it — carefully, with the data-loss risk made unmistakable.

The sanctuary doesn’t end at your front door. Sometimes you need to open a journal on a bus, in a waiting room, on a couch with family in the same room. The threat in those moments isn’t a hacker on the other side of the world — it’s the person sitting next to you, glancing over your shoulder.

That’s what the Privacy Veil is for. The Veil is a visual boundary, not a cryptographic one. When an entry is veiled, its body is hidden behind a soft cover until you intentionally tap to reveal it — so a casual glance at your screen sees a title and a calm placeholder, not the contents of someone’s heart. It’s designed for the threat that actually shows up most often in plural life: shoulder-surfing in public spaces, a partner walking past, a kid reaching for the phone.

The Veil isn’t encryption and we don’t pretend it is. It’s a curtain you can pull across a window. The window’s glass — the actual at-rest protection of your data — is handled separately, on the server. The two work together: the server keeps strangers out of the house, and the Veil keeps the room you’re sitting in private from the people next to you.

Our System Sanctuary is built by a parent, currently as a one-person engineering effort, for the plural and DID community. It started because of one person — a daughter newly figuring out her own system — and grew from there.

There is no investor pressure. There is no growth team. There are no advertising contracts. We do not sell your data. We do not train AI models on your data. We do not have third-party trackers. Every design decision in the app is filtered through one question: would this be safe and kind for someone in their hardest moment?

This will scale slowly and on purpose. We’d rather grow with the community than at the community.

The early period of an app is the time when its community shapes it. If something here matters to you and isn’t working — tell us. If something is missing that the plural community needs — ask. If you’d rather we change direction on something, like privacy or how a feature is named — push back.

Reach us at admin@oursystemsanctuary.com. We read everything.