2026.10.16
PrivacyNotes.app: Open-Source Notes Built Around a Recovery Phrase
PrivacyNotes.app combines encrypted notes, tasks, journals, passwords, and attachments for users willing to manage a phrase-based key.
What the project is for
PrivacyNotes.app is an end-to-end encrypted application for personal information. Its documented scope includes notes, tasks, journals, a password vault, file attachments, and bookmarks. The project publishes a browser client as well as clients for macOS, Windows, Linux, Android, and iOS. Its focus is less on team collaboration than on keeping personal records inside a client-side encryption model.
The project uses a 12-word BIP-39 phrase as the identity and key source. According to the README, phrase-based sign-up does not require an email address, password, or conventional account. The documented design uses HKDF-SHA256 for derivation, alongside XChaCha20-Poly1305 encryption and Ed25519 signatures. The repository includes the client applications, shared cryptographic code, a security document, and a threat model, giving technically capable users material to inspect rather than only a product summary.
Image source: PrivacyNotes.app. Published by the project; the interface may vary by version.
Who may benefit
The project may suit people who want to reduce exposure of account identifiers, access personal notes across devices, and accept direct responsibility for key custody. Developers, security reviewers, and self-hosting practitioners can inspect the published client, cryptographic paths, and threat model when assessing whether the design fits their requirements.
It is less suitable for users who expect ordinary password reset flows without first understanding recovery-phrase management. The supplied sources do not document a recovery guarantee, so adopters should not assume that losing the phrase can be resolved through customer support.
Image source: PrivacyNotes.app. Published by the project; the interface may vary by version.
Documented capabilities and limits
PrivacyNotes.app brings notes, journals, tasks, passwords, attachments, and bookmarks under one documented key model and supports several client platforms. The README says that, under self-custody, the server receives ciphertext and related data rather than note titles and bodies. This is a project claim and an inspectable design target, not an independent audit result established by this article.
The custody choice matters. Sign-up through Google, Apple, or GitHub can select a custodial mode. The README states that, in this mode, the phrase is stored on the server under a key held by the service. That arrangement should therefore be evaluated differently from phrase-based self-custody. The README also indicates that a third-party audit has not yet been completed; the provided sources do not support describing the project as independently audited.
Deployment and adoption considerations
Before adoption, decide how the 12-word phrase will be generated, backed up, and protected over time. Teams should also review the trust boundaries of the browser or device, the synchronization service, and any chosen custody mode. The repository points reviewers to its crypto files, SECURITY.md, THREAT_MODEL.md, and VERIFY.md for implementation and verification context.
The official release page lists version 0.653.1 and a SHA-256 checksum file. Installers or distributed builds should still be checked against the project’s published release process. The repository uses AGPL-3.0, so organizations modifying and offering the software as a network service should include license obligations in their release and compliance review.
The supplied sources do not establish minimum hardware requirements, performance figures, pricing, a complete self-hosting procedure, or a full compatibility matrix. Those points remain unconfirmed and should be resolved before production planning.
Sources
Sources checked: 2026-10-16