Note App Privacy: Check Where Your Notes Live Before You Check the Encryption

2026-09-12

Take a second to think about what's actually in your notes app right now.

The last four digits of an account number. Something a doctor said. Second thoughts about a job. A kid's name and birthday. A password hint. Nothing classified — but plenty that you'd rather nobody else read.

So, one question: where is the original of that note right now?

Most people can't answer precisely. "In the cloud somewhere" is the usual response. And that question is the single most important one in note app privacy — more important than whether the app says it encrypts things.

The short version. Three things to check:

1. Where the original of your note is stored
2. Who holds the key to that place
3. Where your login credentials end up

"Encrypted" is a weaker promise than it sounds

Encryption in transit isn't a feature

You've seen the line on plenty of landing pages: "Encrypted in transit", or "protected with SSL."

That's the baseline. Nearly every website does it. All that phrase guarantees is that your note is hard to intercept while it's crossing the internet.

It says nothing at all about what state it's in once it arrives.

The real question is who holds the key

"Encrypted at rest on our servers" is just as common. Go one step deeper and it splits in two:

• The company holds the key. Their servers can open your notes when they need to. If the app offers server-side search or previews, it generally has to work this way.
• Only you hold the key. The company genuinely can't open them — but lose your password and nothing can be recovered.

The first isn't inherently bad. It just means "we encrypt it" is closer to "we promise not to look." That's a policy, not a guarantee. Policies change when priorities change, when a company is acquired, or when a server is breached.

Three checks worth doing

1. Find out where the original lives

The clearest test is this: if you delete the app, can you still read your notes?

• No → the original lives on that company's servers.
• Yes → the original lives in your own storage (your device, or your own cloud).

When the original is on your side, an incident at that company doesn't touch your notes. They were never there to begin with.

2. Search the policy for two words

You don't have to read the whole privacy policy. Hit Ctrl+F and search for two terms:

• "content" or "user-generated" — see what the company is permitted to do with the things you write.
• "third part" (catches third party and third parties) — see where it's allowed to go.

Many policies now include AI training clauses too. There's usually a way to opt out, but it's worth knowing what the default is.

3. Look at where your login token is kept

This one gets skipped, and it's where real-world breaches actually bite.

For a notes app to reach your cloud, it needs an access token. If that token is stored in the company's own database, then a single breach of that database hands over every user's cloud access at once.

Even if the app never stored a line of your note text, holding the tokens gets to much the same place.

The strongest privacy is not collecting it

Read enough breach reports and the pattern is always the same: data that was gathered in one place leaves in one piece.

So the simplest, most durable defense isn't stronger encryption. It's not gathering it. Data that isn't on a server can't leak from one.

For that to work, the structure has to look like this:

• The original of each note lives in your own cloud
• The app runs in your browser and talks to that cloud directly
• The company's server isn't in the middle

This is the structure Fenex chose

That's the reason Fenex exists.

Notes are saved to your own Google Drive as .md files. No copy is kept on a Fenex server. Your writing travels between your browser and your Drive, and nowhere else.

Not even the login token is kept server-side. It's encrypted and handed back to your browser as a cookie. There is no user database to speak of — nothing is pooled, so there's no pool to breach.

You can cut the connection yourself, any time. Revoke access from the third-party apps list in your Google account settings and it's cut immediately. Your note files stay in your Drive regardless. The only thing removed is the connection.

Put differently: instead of promising to protect your notes, Fenex made a point of not having them.

Wrapping up

Run through it in this order:

"We don't have it" is always a stronger structure than "we'll keep it safe." Promises can change; structure rarely does.

Go check the app you're using now. If you decide you'd rather hold the originals yourself, open Fenex and write a note. No install, no sign-up.

If you'd like the more basic version of this idea first, start with Writing Notes as Markdown in Google Drive.