Privacy

This describes what the sync service actually stores and what it is technically incapable of reading. It is a description of how the system is built, not a statement of intent — the difference matters, because intent can be revised and architecture cannot be, quietly.

What is stored

Everything below is what the server holds. There is nothing else.

Account handle

The name you choose to sign in with. No email address, phone number or real name is requested or stored.

Passkey

The public half of the credential your device creates, and its identifier. The private half never leaves your device. There is no password field anywhere in the database.

Device keys

For each device you enrol: its public keys, a label you choose, and a fingerprint. All public material — it permits the server to check that a change came from one of your devices, and nothing more.

Encrypted changes

Each edit is stored as an encrypted block, tagged with which note it belongs to, which of your devices sent it, its size, and when it arrived. The contents are ciphertext.

Attachments

Images and PDFs are encrypted before upload and stored under a name derived from the encrypted bytes. Their size is visible; their content is not.

Session

A hash of your session token with its expiry. The token itself is not stored, so a copy of the database yields no usable sessions.

IP address

Seen while your device is connected, because a network connection requires it, and used to limit abusive request rates. It is not written to any log or database.

What cannot be read

Notes are encrypted on your device before they are transmitted. The keys are generated on your devices and shared only between them, wrapped so that only a device you have enrolled can unwrap them. The server is never given a key.

This means the operator of this service cannot read your handwriting, your typed text, your note titles, or your attachments — not on request, not under compulsion, and not by choosing to change the code later, because the data already stored is ciphertext and the keys to it are not here.

What encryption does not conceal is the shape of your usage: that an account exists, how many notes it has, when it is active, and roughly how much is written. Anyone operating a sync service can see this much, and it is listed above rather than glossed over.

Logging

No request logs are kept. The web server records no access log, and the application records nothing per request. There is consequently no record of which notes you opened, when you read them, or from where.

Errors and operational events are logged without note identifiers or account handles, and are rotated away.

Retention and deletion

Data is kept until you delete it. Deleting your account removes the account, its passkeys, its devices, its sessions, its notes, every stored change and every attachment, in a single operation — nothing is retained in an orphaned form. This is enforced by the database itself rather than by cleanup code that could be forgotten.

There are no backups held elsewhere at present. That is stated so it is not mistaken for a guarantee of durability: if this server is lost, notes that exist only here are lost with it. Your devices keep full local copies.

Third parties and tracking

There are none. No analytics, no advertising, no crash reporting, no embedded fonts or scripts from other hosts, no cookies except the single one that keeps you signed in. Nothing is shared with anyone, because there is no readable content to share and no arrangement to share it under.

Where it runs

On a single server in Germany. Connections are encrypted in transit with TLS, in addition to the end-to-end encryption of the notes themselves.

Contact

An address for privacy enquiries will be published here before the apps are released. Until then the service has no users to correspond with — it is running, but nothing is installable yet.

Changes

If this description stops matching what the system does, it is a defect in the description. Material changes will be noted here with a date rather than replaced silently.

Last updated 15 August 2026.