How your data is kept secure

No. They're encrypted in your browser with a key that only your password, your recovery code or one of your passkeys can unlock, and that key never reaches us unlocked. What we store is unreadable without it.

Use the recovery code you saved at signup, or a passkey if you've added one. Without any of them, no one can open your account, including us. There is no reset.

No. Your browser works out a sign-in proof from your password and sends only that. Your password, and the key that opens your entries, stay on your device.

Someone who copied our database would get encrypted data and email addresses. To read your entries they would still need your password or your recovery code, and a long, unusual password is what protects you there. Someone who took over our servers could do more: delete your stored entries or replace them with junk, or change the app's code to capture your password as you type it. That last risk is the one no web app can rule out, so keep a recent backup export.

Yes, three things. A weak password: anyone holding a copy of our database can try guesses against it. Tampered app code: the app comes from our servers on every visit, and an altered copy could capture your password before anything is encrypted. And your own device: harmful software or a browser extension can see whatever you see on screen.

Someone who has your password can read your entries, just as you can. Use a password you use nowhere else, and turn on two-factor sign-in, so a stolen password alone can't sign in. We email you whenever your password, recovery code, passkeys or two-factor settings change. Someone who takes over a signed-in session, without your password, can't read your entries but could delete them, which is another reason to keep a recent backup export.

The copy kept in your browser is encrypted, and nothing stored there can be used to test guesses at your password. The app locks itself after at most 15 minutes without use, and you can make that shorter in Settings. While it's unlocked, anyone at the keyboard sees what you see, so lock it when you step away.

Yes, both, from Settings. Your password stays the master key; a passkey or a code never replaces it.

Yes. Chrome, Edge and Android install it with one tap, and on iPhone, iPad or a Mac you add it from Safari's Share or File menu. It opens in its own window from your home screen or dock. How to install it.

We can only hand over what we have: your email address, encrypted data we can't open, and the facts listed under "What do you know about me?" below.

Several of these claims you can see for yourself, some with no tools and some with your browser's developer tools. Check our claims walks you through them.

Use our vulnerability report form.Use the contact form and choose Security issue. Please give us a reasonable time to fix it before you tell anyone else.

Your email address; roughly how many entries you have and when they change; and, in our server logs for 3 months, the internet address each request came from, your browser type and the addresses requested. Not what's in your entries.

No. Your entries are encrypted on your device before they reach us, so there's nothing in them for us to sell. The one thing we can read that identifies you is your email address, and we never sell or share it. No ads, and nothing inside the app tracks you. Our network and security provider, which carries all our traffic, keeps visit totals; see the privacy policy.

A few companies help run the service: our host, our email sender, a network protection service, the map provider, a backup storage service and a log service. None of them can read your entries. They're all described in the Privacy Policy.

The map stays off in each browser until you accept a short notice. When it's on, the map provider sends the map pictures for the areas you look at, so it sees those areas, your internet address and your browser. It never sees your entries: the pins are drawn on your device. Using 📍 to fill in where you are also shows it the area around you at that moment.

On our servers in North America, encrypted, and in your browser, encrypted too. The companies that help run the service may handle data in other countries; see the privacy policy.

We keep your email address partly so we can tell you if the service is ever closing. You can export your entries from Settings at any time: a plain export is an ordinary text file you can read without us. A sealed export needs Notchbox to open, so it won't help once we're gone.

Export a backup if you want one, then delete your account in Settings. Your email and all your encrypted data are removed. We keep only a record that you agreed to our Terms, described in the privacy policy.