Storyline technical documentation
How Storyline is built: a private writing studio with no backend, AI that stays on the device for privileged work, one observed door to the web, and a log you can verify.
Storyline is a writing studio for iPhone, iPad and Mac, made for people whose words are confidential by law: clinicians, lawyers, journalists, and anyone who cannot paste sensitive work into a cloud chatbot. It is a native app written in Swift 6 and SwiftUI, with SwiftData for storage. There is no Storyline backend. The only cloud it uses is your own iCloud private database.
These pages explain how it works, for developers and for anyone who would rather check the privacy claims than take them on trust. They describe Storyline 1.2.1, the version on the App Store. Anything built for a later release, or only designed so far, is on the roadmap.
Who it is for
A therapist keeping session notes, a lawyer drafting privileged text, a journalist protecting a source. For them, sharing a draft with a third-party AI service could be considered a disclosure. Storyline lets you mark a project as privileged (the app also calls these Vault projects), and from then on its AI runs only on the device. Healthcare, Legal and Journalism projects start privileged by default.
Principles
- Privacy as architecture, not policy. There is no server, no account and no tracking, so there is no copy of your work on our side to breach, lose or be asked to hand over.
- On-device first. Privileged work runs only on the device in front of you. For other projects you choose: prefer on-device (this device, then another of yours, then the cloud with your own key), or the best model for each task.
- Fail closed. When a key is missing, a check cannot run or a policy is unclear, Storyline withholds or stays on the device. It never falls back to a convenient all-clear.
- Verifiable claims. Each privacy claim in the interface is mapped to the code that makes it true, the audit log can be verified on your own device, and every crossing to the network is recorded verbatim for you to read.
- AI suggestions are branches. The co-author’s work arrives as branches you adopt or discard. Nothing touches your page until you say so.
- Derivatives inherit privilege. Snapshots, branches, AI outputs and logs made from privileged content are protected like the content itself, or are not stored at all.
The pieces
| Piece | What it does | Key types |
|---|---|---|
| Vault | Derives your key from a passphrase, seals content with AES-GCM, unlocks with Face ID or Touch ID | CryptoVault, KDFScheme |
| Audit chain | A hash-chained record of every consequential action, each entry signed by a Secure Enclave key | AuditEntry, AuditChainSigner |
| AI router | Picks a model for each request inside the project’s policy, and refuses rather than leak | AIService, AIAccessPolicy |
| Egress funnel | The single path from research to the network, with the leak guard and the Data flow ledger | EgressFunnel, LeakGuard, EgressRecord |
| Research desk | Imports pages, PDFs, notes and audio, reads them on the device and cites them into drafts | ResearchService, ReadabilityCleaner |
| Sync | Mirrors your data to your iCloud private database and turns sync conflicts into branches | SyncCoordinator, ConflictDetector |
Where to start
- Architecture: modules, the data model, storage and sync, the branch contract and the professional registers.
- AI routing: the providers, the three access policies and the fail-closed rule for privileged work.
- Security: the vault, encryption at rest, the audit chain, the Derivative Privilege Rule and the threat model.
- Research and egress: the research desk, screening in both directions and the Data flow ledger.
- Verification: how to check the claims yourself, and how each release keeps them tied to code.
- Roadmap: what is in progress or designed but not shipped.
The app page has the listing, and the Storyline showcase is the short version.