How CuratorNote works
CuratorNote combines authentication, a browser-held encryption key, local-first records, encrypted synchronization, and deliberate human review. This walkthrough separates behavior present in the current product from design principles and roadmap direction.
From identity to accountable work.
Solid lines describe the current application path. The final extension stage is visibly marked as roadmap.
- 01Available now
Authenticate
Sign in with email OTP or Google OAuth. Email codes expire after five minutes, OAuth state after ten minutes, and the browser session uses an HttpOnly, SameSite=Lax cookie.
- 02Available now
Unlock
Create or unlock the browser encryption key through the master-password gate. Losing the key or password can make protected content unrecoverable; the service cannot replace device hygiene.
- 03Available now
Work locally
The app maintains a local-first working set in browser IndexedDB so the interface can organize notes and related records near the user.
- 04Available now
Encrypt
Protected record content is encrypted in the browser before synchronization. Authentication, routing, identifiers, timestamps, and other server-visible metadata still cross the service boundary.
- 05Available now
Synchronize
The Worker coordinates authenticated APIs and Cloudflare-backed D1, Durable Object, and R2 storage. Network availability, concurrency, browser state, and media handling create practical limitations.
- 06Roadmap
Review and extend
Notes are intended to ground visible human review of AI-assisted work. Kanban-style agent collaboration is roadmap direction; it is not presented here as a generally available autonomous-agent service.
Limitations are part of the model.
Browser compromise, lost credentials, deliberately shared plaintext, network metadata, and incomplete roadmap features remain outside or at the edge of the protection boundary. Review the detailed security guide before relying on the model for sensitive work.