What end-to-end encryption protects
- Note titles and rich-text content
- Images and audio recordings
- Supported sketch files and previews
- The user master key, wrapped separately for each approved device
What is not encrypted
The following metadata is not encrypted and can be visible to the sync service: labels, note colors, timestamps, pin, archive, and trash state. It is used for filtering, display, and sync.
Device approval and recovery
Every approved device has a X25519 key pair. A recovery passphrase uses Argon2id to derive the key that protects recovery material. Losing every approved device and the recovery passphrase can make synchronized encrypted notes unrecoverable.
