Security and your data

The short version

Your notes are plain Markdown files on your own devices. ZenNotes Cloud is optional: without it, your notes never reach us. With end-to-end encryption turned on, your notes, attachments, and file and folder names are encrypted on your devices with a key only you hold, so ZenNotes cannot read them.

End-to-end encryption is in beta and is off unless you turn it on. Vaults without it are stored in a form our service can read, protected as described below.

Where your notes live

Every note is a file in a folder you choose. ZenNotes works fully offline, and the files stay readable by any text editor whether or not you use Cloud.

If you use Cloud, a copy of each linked vault is kept on our servers so your devices can sync, and so you can make backups and publish notes. Signing out or unlinking never removes files from your devices.

Encryption

• In transit. The apps talk to ZenNotes Cloud only over HTTPS. Files move to and from storage over HTTPS too, through short-lived links.
• At rest. Files are kept in Cloudflare R2, which encrypts every stored object with AES-256. This protects against stolen disks, not against ZenNotes itself, which holds the keys for this layer.
• End to end (beta). For an encrypted vault, each device encrypts note contents, attachments, file and folder names, and the vault's name before anything is uploaded. Keys come from a passphrase you choose and never leave your devices. We use AES-256-GCM with a fresh key for every file, and Argon2id to turn your passphrase into a key. The full design is published in the encryption specification, and the code that encrypts your notes is in the apps' public source.

What we can and cannot see

We need the visible items to run the service: sizes for storage limits, timing for sync, devices so you can disconnect them. File sizes in an encrypted vault are close to their real sizes, and two files whose names differ only in capital letters are recognizable as the same name, because the service still has to stop two files from claiming one path.

We do not use your notes to train AI models or for advertising, and we do not sell your data.

Your passphrase and recovery key

When you turn on end-to-end encryption, you choose a passphrase and receive a 24-word recovery key. Either one unlocks your encrypted vaults on a new device. We never receive either of them, and we cannot reset them.

If you lose both, the encrypted copy in Cloud cannot be read by anyone, including us. The notes on your devices are not affected: you can start again with a new passphrase and upload them from any device that has them.

Choose a passphrase you do not use anywhere else. Someone who obtained our stored data could try to guess it, which our key derivation makes slow but not impossible for a short or common passphrase.

Publishing

Publishing a note creates a separate, readable copy so anyone with the link can view it, including from an encrypted vault. The copy stays readable until you unpublish the note, which deletes it.

Account security

• Sign in with an email and password, or with Google. Passwords are stored only as bcrypt hashes.
• Two-factor authentication with an authenticator app is available in your account settings.
• Every app you connect appears in your account settings, where you can disconnect it. Signing out of an app disconnects it as well.

Where your data is stored

The ZenNotes Cloud service and its database run on Laravel Cloud, in Amazon Web Services' US East (Ohio) region. Files and backups are stored in Cloudflare R2. Payments go through Stripe, and email is sent through Cloudflare and Resend. The Cloud privacy policy lists every provider and what each one receives.

Who can access your data

ZenNotes is made by Lumary Labs, a small independent company. Only the founder has administrative access to the production systems, and that access requires two-factor authentication. We look at account or vault data only to keep the service running, to investigate a problem you report, or when the law requires it. For encrypted vaults, we can only ever see the items listed above.

Backups, retention, and deletion

• Backups you make, or that Cloud makes automatically, are kept for your plan's retention period. A deleted or expired backup is removed permanently within 8 days.
• We keep separate recovery copies of each vault for 10 days, and point-in-time database backups for 10 days, so we can recover from our own mistakes. Copies of an encrypted vault stay encrypted.
• Older revisions of your files are removed after about 90 days unless a backup still needs them.
• When your Cloud access ends, you have 30 days to download your data before it is deleted. Deleting a vault or your account removes its Cloud copy; recovery and database copies age out within the periods above.

If something goes wrong

If we learn of a security incident that affects your data, we will tell you without undue delay, explain what happened and what it means for you, and notify regulators where the law requires it.

Reporting a vulnerability

If you find a security problem, email [email protected] before telling anyone else, so we can fix it first. We will reply, keep you updated, and credit you if you would like. The same address is in our security.txt.

Audits and source code

ZenNotes Cloud has not had an independent security audit yet. The encryption design is published and the apps' source code is public on GitHub, but published is not the same as reviewed.

The desktop, iPhone, and Android apps and the self-hosted server are public on GitHub. The ZenNotes Cloud service is not public.

Requests from authorities

We have not received any government or law-enforcement request for user data. We would review any request carefully, ask for narrower scope where we can, and tell affected users unless the law forbids it. For an encrypted vault we could only hand over what we can see, as listed above.

Limits worth knowing

• End-to-end encryption protects the copy in Cloud. It cannot protect notes on a device someone else can unlock, or from software running on that device.
• A service that misbehaves could withhold your newest changes or serve an older version of a file. It could not read or forge your notes, and your devices keep their own copies.
• Encrypted vaults cannot be exported as a ZIP from the website, because the website cannot read them. Save a readable archive from the ZenNotes desktop app instead.

Contact

For account, billing, or privacy requests, email [email protected]. Please do not post private notes or payment details in public issues.