Privacy Policy

LibreNotes is a free, open-source (AGPLv3) note-taking app for Android, Linux, and the web, developed by an individual developer. This policy covers the LibreNotes apps and the project website at librenotes.ayopili.com. The complete source code is public at github.com/Piliii/LibreNotes, so every claim here can be checked against the code.

Nothing. The app has no developer-operated backend. It does not contact any server operated by the developer, and it contains no analytics, crash-reporting, advertising, or tracking code. It does not use Google Play Services or Firebase.

• Your notes.The title and body of each note are encrypted before being written to the app's local database, using a key that is kept in your system's secure storage (the platform keyring). Other note properties, such as color, pinned/archived state, and timestamps, are stored in the app's private database on your device.
• Sync settings (only if you turn sync on): the address of your server, an access token for it, and the encrypted key material needed to unlock your notes on a new device.
• Files you pick. If you import or export notes as Markdown files, the app reads or writes only the files and folder you choose in the system file picker.

All of this stays in the app's private storage on your device. Uninstalling the app or clearing its data removes it.

Sync is off until you connect the app to a LibreNotes server of your choosing. That might be one you host yourself, for example on your home network, or one run by someone else you trust, such as a family member or friend. The developer does not run or have access to any server on your behalf.

Notes are encrypted on your device before they are sent. The server only ever stores:

• the encrypted note contents (ciphertext) and its per-write nonce;
• sync bookkeeping: a random note ID, a revision number, a change counter, deleted/purged flags, and a last-modified time;
• your wrapped (passphrase-encrypted) key and its salt and key-derivation settings, which the server cannot open.

The server never has your passphrase or your encryption key, so it cannot read your notes. Whoever runs the server can see the bookkeeping above and roughly how large each encrypted note is, and can see the network address that connects to it.

Transport security is up to you. The app connects to whatever address you enter. If you use a plain http:// address, for example on a home network, the connection itself is not encrypted, although note contents remain end-to-end encrypted either way. For access from outside your home network, use a private network such as WireGuard or Tailscale, or put the server behind HTTPS.

The Android app requests one permission: Internet, used only to talk to the sync server you configure. It does not request access to your location, contacts, camera, microphone, photos, or shared storage.

• In the app: none. The app does not embed third-party SDKs that collect data.
• Links in your notes:tapping a link opens it in your browser or another app. That site's own privacy policy applies from then on.
• Where you install it from: Google Play, F-Droid, GitHub, and package repositories operate under their own policies and may keep their own download or installation records. The app cannot see or control those, and does not send anything to them.

• The website's own code sets no cookies and runs no analytics or advertising scripts.
• Its text font is loaded from a third-party font service, Bunny Fonts (fonts.bunny.net), so your browser makes a request to that service, which can see your IP address, when you view the site.
• The site is hosted on Vercel and protected by Cloudflare. Those services may set their own technical cookies and keep ordinary server logs (such as IP address and requested page) for security and operations, under their own privacy policies.
• The live demo saves its sample notes in your browser's local storage only. They are never sent anywhere. The "what's new" notice also remembers the last version you saw in local storage. Clearing your browser data removes both.

LibreNotes is a general-purpose notes app and is not directed at children. Because it collects no personal data from anyone, it collects none from children either.

Your notes are yours. You can export them as Markdown files at any time, delete them in the app, and remove everything by uninstalling. Data on a sync server is controlled by whoever runs that server, which is you if you set it up. Since the developer holds no data about you, there is nothing for the developer to access, correct, or delete on your behalf.

If the app's data practices ever change, this page will be updated and the date at the top revised. The full history is visible in the project's public repository.

Questions about this policy: contact@ayopili.com. For security issues, please use GitHub private security advisories.