We can't read your notes. Here's why.

Encrypted before it leaves your device

Every note is encrypted on your device with AES-256-GCM under its own random key, and those keys are encrypted under an account key only your devices hold. Titles, note types, templates, settings, Oracle conversations and Vault files are encrypted the same way.

Your password never reaches our servers

Your device stretches your password with Argon2id, which makes guessing slow and expensive, and derives two keys from it. One unlocks your account key and the other signs you in. The server only gets the sign-in key, which can't decrypt anything.

What our servers can and cannot see

Cannot see

• Note titles, text and attachments
• Note types and templates
• Oracle conversations
• Your settings
• Your password or recovery key

Can see

• Your email address and username
• How many encrypted records you have, their sizes and when they changed
• Which accounts you share notes with
• Your plan and AI usage
• The few settings the server acts on, such as how long archived notes are kept

Sharing stays encrypted

Shared notes are encrypted to each member's devices (HPKE), and every edit and membership change is signed and checked. Public links carry the key after the #, which browsers never send to a server.

AI is optional and limited to what you allow

Only Oracle and voice transcription use AI, and only with what you allow.

Recovery without a back door

We can't read your notes, so we can't reset our way into them. Your 12-word recovery key unlocks your account if you forget your password. Without your password or recovery key, nobody can decrypt your notes, including us.

Open to inspection

The iOS app is open source under the AGPL-3.0. The encryption formats are pinned by shared test vectors that the web, mobile and server code all verify.