Security at SyncNote

Last reviewed: August 28, 2026

SyncNote is built local-first: your notes live on your device by default. This page explains, feature by feature, what stays on your device, what is encrypted, and exactly what leaves your device when you turn on optional features.

Local-first storage

Every note you write is stored locally on your device in an embedded SQLite database. Nothing is sent to any server unless you explicitly turn on Cloud Backup or Device Sync. If you never enable those features, your notes never leave your device.

Private Vault (on-device only)

Vault notes are protected with a passcode (and optional biometric unlock). The encryption key is derived from your passcode using key-stretching, and vault notes are stored with authenticated encryption, so tampering is detectable. Vault notes are never uploaded to cloud backup and never synced to other devices — they exist only on the device where you created them.

Cloud Backup (optional, encrypted)

When you sign in with Google and enable Cloud Backup, each note is encrypted on your device with AES-256-GCM — using a fresh random nonce per note — before it is uploaded. Only the encrypted content is stored in your personal Firebase namespace.

• A random 256-bit encryption key is generated on your device.
• That key is stored in your Google Drive App Data folder — a hidden folder that only this app can access on your account — and cached in your device's secure storage.
• Because the key lives in your Google account, SyncNote cannot read your backed-up notes, and you can restore them on a new device by signing in.
• You can delete all backup data at any time from Settings.

Device Sync (optional)

When you pair two devices with a 6-digit code, a shared workspace is created in Firebase Firestore. Only notes you explicitly share to that workspace are synced between paired devices; private and vault notes are never uploaded.

Authentication

Sign-in is optional and only needed for Cloud Backup. It uses Google Sign-In via Firebase Authentication. SyncNote stores your email and display name for account identification and does not store passwords. Google Sign-In is never used for advertising or analytics.

Data in transit and at rest

• All data transmitted to Firebase services is encrypted in transit using TLS (HTTPS).
• Firebase Firestore encrypts data at rest.
• Firestore security rules restrict access so you can only read and write your own data.

What SyncNote does not collect

The SyncNote app contains no analytics, no crash reporting, no advertising identifiers, no location data, and no third-party data-collection SDKs. Our website uses only privacy-friendly, cookie-free analytics that collect anonymous, aggregate visit data — see the Privacy Policy for details.

Reporting a security issue

If you believe you have found a security vulnerability, please contact us through the app's support channel so we can investigate and respond.