Your composition fingerprint, your envelopes, your documents — built by you, held under a key derived from your own identity, removable whenever you say so. Red Stet is a personal tool. Schools are a use case, not the owner.
When you signed up to Red Stet, you opted into the recording layer. Three things accumulate when you write here. All three are yours.
The granular record of a writing session. The recording is plain-text events inside the editor — keystrokes, paste actions, cursor moves, timestamps. Paste content from your clipboard IS recorded so the replay can show what was actually inserted; before any paste reaches the bundle, a sensitive-content scan flags credit-card numbers, API keys, SSNs, JWTs, and similar credentials, and a modal lets you choose to redact those in the recording, allow the full content, or cancel the paste. Those events are what an EAV envelope verifies later, and what your composition fingerprint is built from.
What does NOT get recorded: no microphone, no camera, no screenshots, no screen recording, no clipboard contents from other apps that you don't paste into the editor, no keystrokes outside this editor window. No browsing history, no location, no device fingerprint. The receipt only sees the page you're writing on — same list, in this order, on every Red Stet surface that touches this.
The per-doc switch lets you turn the recording off for a specific doc whenever you want. Your account-level opt-in stays put for the rest of your work.
What you wrote. Document bodies and the editorial marks you place on them. Up to 50 versions per document, retained for your own restore.
How Red Stet knows it's you. Name and email — only what Clerk hands us when you sign in. Stripe handles payment data directly; raw card numbers never reach our systems.
EAV — Encrypted Authorship Verification. The spec is in the open at /EAV_SPEC.md; this is the short version.
Every writing session ends with an EAV-1 envelope. The event stream is encrypted under a fresh per-recording Data Encryption Key (AES-256-GCM). That DEK is then wrapped under your Key Encryption Key, derived via HKDF-SHA256 from your Clerk identity and a server-held salt. Neither half is sufficient alone — the salt without the identity gets you nothing; the identity without the salt gets you nothing. The envelope is signed (ES256 / JWS) and anchored to Sigstore Rekor for tamper-evident timestamping.
After envelope finalize, we don't read your events as plaintext. Decryption requires your key — or, if you grant one, a collaborator's key. When you share access (a teacher reviewing an assignment, a co-author, an editor), the same DEK is re-wrapped under their KEK. The encrypted events themselves never re-encrypt, never re-decrypt server-side. Access changes the wrapping; the payload is settled the moment the envelope seals.
The signing key's public half lives at /.well-known/jwks.json. The verifier source is open. Any third-party tool that implements EAV can validate a Red Stet envelope without contacting us. The validity of your record doesn't depend on Red Stet existing forever.
Storage compromise reveals only ciphertext. The KEK salt sits in a separate secret. Your Clerk identity is held by Clerk. Three things have to break for an attacker to read one writer's recordings. — How EAV holds up
Read-aloud and voice typing use the speech engines built into your browser. Both are optional and both are off by default.
Read-aloud sends the text being read to the browser's voice engine. Voice typing sends microphone audio to the browser's speech recogniser. On Chrome, both engines are network services operated by Google, so Google receives that content. Safari and Edge use their own engines; which one runs depends on your browser.
Red Stet asks for your consent the first time you use each feature, records the consent with the date and the exact wording shown, and does not ask again until that wording changes. Declining leaves the feature off. You can turn either one off later in Settings; turning it off stops all further sending.
If you do not use these features, no writing or audio is sent to a speech engine. Recording, encryption, and Rekor anchoring do not use them.
Long, by default. An authorship record gets more valuable the longer it goes back.
Personal recordings, composition fingerprint, and registry standing persist indefinitely. The composition fingerprint is built across years; the first weeks of a fresh-wipe profile produce no useful signal, so trimming it is rarely what a writer wants. The Rekor anchor on a sealed envelope persists for the lifetime of the log, outside our hands by design.
The 50-version document history rolls — older versions purge as new ones land. Backups run continuously with a 30-day point-in-time recovery window. Outside that window, a deletion is final.
When you write inside a school's classroom for an assignment, that recording is governed differently — the school sets the retention window for educational records, and at year-end the teacher's view of the classroom layer wipes. Your composition fingerprint and your EAV envelopes don't. The classroom is the school's working surface for a term; your authorship record is yours for life. /ferpa/ covers the boundary in detail.
Two self-serve paths. Both live in Customizations → Privacy & data.
Wipe everything. Type the phrase wipe my Red Stet history to start a 7-day countdown. Cancel from any signed-in device during the countdown. After it runs, the cascade deletes recordings, composition fingerprint, chain index, registry standing, and the account row.
Close account, keep record. Severs sign-in identity. Keeps published-registry recordings as anonymous-but-attributed entries — useful when you want past authorship claims preserved but you're done with the account. Also one-way; a new sign-up doesn't inherit the anonymized records.
The 7-day cooldown on wipe catches the impulse delete on day three, and blocks an account takeover from doing irreversible damage before you can sign in and cancel. Anonymization runs immediately; it's the gentler path.
Schools use Red Stet for assignments. When they do, FERPA constrains the school's use of the assignment submissions — not your personal composition fingerprint, not your personal documents.
If you signed in through your school's LMS, the self-serve wipe and anonymize buttons are hidden for the account itself. Severing the sign-in identity locally would break the next LMS launch, and deleting an educational record without the school's authorization would put the district in violation of FERPA — so deletion of school-owned records routes through the school's records officer. Your personal layer — composition fingerprint, personal docs, personal envelopes outside the classroom — stays under your authority regardless.
For the regulatory framework — what falls under the school's authority vs. what stays yours, what the school signs, what we sign, who has standing to request what — see /ferpa/.
Questions, deletion requests, breach notifications, DPA templates: [email protected]. A human reviews every destructive request before it runs. Two business days typical; sooner when the request is time-bound.