Free tool

Who actually wants your data?

Most people's realistic threats are boring, and that is useful to know. This worksheet helps you name them. Everything on this page runs in your browser: the script behind it contains no network code at all, so ticking boxes never leaves the page, which you can verify by reading it. With JavaScript off, the whole worksheet still reads as a printable paper checklist.

Step 1

Who could realistically want your data

Tick what applies to your life, not what a spy film says. The notes are honest about likelihood; grounding for the framing is in the threat model, honestly and what your AI cloud can and cannot see.

Adversaries Casual snooping. Someone who picks up your unlocked phone. Common, low effort, opportunistic, and stopped by very ordinary measures. A controlling partner or family member. Someone with physical access to your devices who may know or demand your codes. When this one applies, it is usually the most serious item on the list. A device thief. Wants the hardware first and your data second; most stolen phones are wiped for resale, but an unlocked one is an open wallet. Data brokers and ad tech. Profiling at scale. The most certain entry on this list: if you use free apps and services, it is already happening. Criminals working breach dumps. They try leaked email and password pairs against every service. You are a target of the reuse pattern, not of you personally. An employer on a managed device. A device your workplace administers can be monitored by policy. Not malice; just how managed devices work. Government legal process. Warrants and subpoenas served on the companies that hold your data. Real, rule-bound, and for most people the least likely entry here.

Step 2

What you actually store

The point of this step is scope: an adversary only matters where it overlaps with data you really keep.

Data you keep Private conversations and a journal. Chats, notes to yourself, anything written in confidence. Photos. Including the ones you would not post. Health information. Conditions, medications, therapy notes, period or fitness tracking. Finances. Banking apps, statements, tax documents, crypto keys. Location history. Where you have been, at what times, on repeat. Work documents. Anything under someone else's confidentiality rules. Passwords themselves. A manager's vault, a notes file, or a paper list.

Step 3

What protects against which threat

Seven ordinary protections against the seven adversaries above. "Helps" means it substantially blocks that adversary; "partial" means it raises the cost without closing the door; "does not help" is printed where that is the honest answer.

Protection	Casual snooping	Partner or family	Device thief	Data brokers	Breach criminals	Employer (managed device)	Legal process
Screen lock with short auto-lock	helps	partial	helps	does not help	does not help	does not help	partial
Full-disk encryption	does not help	does not help	helps	does not help	does not help	does not help	partial
Unique passwords in a manager	does not help	partial	partial	does not help	helps	does not help	does not help
Two-factor authentication	does not help	partial	partial	does not help	helps	does not help	does not help
End-to-end encrypted apps	does not help	does not help	partial	helps	partial	partial	partial
Breach-alert monitoring	does not help	does not help	does not help	does not help	helps	does not help	does not help
Limiting what you hand to free services	does not help	does not help	does not help	helps	partial	does not help	partial

Reasoning behind the sharper cells: a screen lock and full-disk encryption do nothing once a device is in use and unlocked, which is exactly when snooping happens. Nothing on this list beats an employer's device administration; the realistic protection there is separation, not software. And against legal process, encryption narrows what a provider can hand over to metadata and to whatever you stored unencrypted elsewhere; it does not make the process go away.

Your summary

What your picks add up to

Tick at least one adversary in step 1 to build a summary. Adding step 2 makes it specific to what you store.

Printing keeps the worksheet and this summary and drops the site chrome. Nothing is saved: reloading the page clears every box.

Read this part

Where Violet does not help

We build an end-to-end encrypted AI companion, so it is fair to ask where that fits this worksheet. Honest answer: encryption of data at rest covers some rows above and not others, and Violet specifically does not protect against:

A compromised or unlocked device. Anything that reads your screen or your device's plaintext sees what you see, encryption or not.
Anyone who learns your passphrase. In a design with no reset flow, the passphrase is the entire wall.
A weak passphrase behind strong key derivation. Key stretching slows guessing; it cannot rescue "violet123".
Sync metadata. A sync server necessarily sees that encrypted envelopes exist, when they move, and how large they are, even when it cannot read one byte inside.
Anything you store in other services. Your email, your cloud photos, and your chat apps keep their own threat models.
And the plainest one: Violet is pre-launch. Today it protects nothing, because it is not in your hands yet.

The full architecture, stated without marketing: how end-to-end encryption protects personal AI data and what your AI cloud can and cannot see.