Privacy Policy

1. The short version

Condei is a notes app. Your notes, their titles, your tags, your folders and your attachments are encrypted on your device before they leave it. We hold the encrypted copies. We do not hold the keys, so we cannot read them — not to help you, not to moderate them, not because someone asked us to.

Encryption hides what you write. It does not hide that you have an account, how many notes are in it, roughly how big they are, or when you last changed one. We can see that, and section 4 lists all of it plainly.

If you choose a name, a username or a photo for your Condei profile, those are not encrypted. We hold them in readable form so that other people can be shown who you are. Section 2.4 says who can see them.

This policy covers your account, your data and the apps. For the one thing the condei.app website itself stores in your browser — a single flag that stops an animation replaying — see the separate Cookie Policy.

2. What we collect

2.1 Things you give us

2.2 Things our servers record because they have to

2.3 What we do not collect

• We do not keep the name Apple or Google sends us. If Apple sends it on your first sign-in, we read it and throw it away; your account is keyed on Apple's identifier. The only name we keep is the profile name you give Condei yourself (section 2.1), which the app may have prefilled from that sign-in for you to accept or change.
• We do not store full IP addresses in our database — only a truncated prefix. Full addresses do appear in our web server's own request logs, and in the logs of the proxy that terminates TLS in front of it, until those logs roll over.
• We do not store the contents of requests to our sign-in endpoints; they are redacted from our logs, along with authorisation headers, refresh tokens and password-derived secrets.
• We do not have, and cannot obtain, your master key, your recovery code, or any decrypted note.

2.4 Your profile

Your profile is the one place where Condei holds something about you in readable form on purpose, because the point of it is for other people to see it. It is not end-to-end encrypted, in the same way your email address is not.

• You. You and the Condei apps signed in to your account see it, and you can change your name and photo whenever you like. A username can be changed once every 30 days. Your old username stays reserved for 30 days, so nobody can take it over at once, and a search for the old one finds no one.
• Other signed-in Condei users, only by your exact username. Someone with a Condei account who types your complete username gets your name, your username and your photo back. Nobody can browse or search for profiles, list accounts or look someone up by name or by part of a username, and the apps do not offer suggestions from Condei's user list. Each account may look up 20 usernames a minute and 200 a day. Checking whether a username is free also tells whoever asks that it is taken, without showing whose it is.
• Your photo is kept as a private file in Cloudflare R2 (section 6) and is handed out only through a link that stops working after 10 minutes, to you and to someone who has just looked you up.
• Blocking. If you block someone, a lookup of your username by them finds no one. Your list of blocks is kept so you can see it and undo it; it is shown to you and to nobody else.
• People you share with. Once you share a note or folder with someone, or someone shares one with you, you each see the other's name, username and photo, and they see them wherever sharing is shown: the share's list of people, who is typing, and @mentions. When you type a username into the share field, the suggestions come from the people you already share with, held on your own device, never from a list of Condei's users.
• Reports. Another Condei user who meets you through sharing, a username or an invitation can report your account with Report @username. A report holds the reporter's account, your account, a reason chosen from a list, any words the reporter adds, and the time. It goes to a review queue that only Condei staff can open, and staff actions on it are recorded (section 9). It never contains any note, and nothing is attached to it from your notes; we cannot read them. We do not tell you who reported you. A closed report is deleted 180 days after it is closed (section 7).
• Our staff can reset your name, reset your username or remove your photo if one breaks our rules, and every such action is recorded and emailed to you (section 9). They cannot see your block list from the console, and they cannot set a name or photo for you.
• People you invite or who invite you. If you invite someone, the email and the page it links to show them your name, username and photo (section 2.5).
• You can leave it empty. A Local Vault or iCloud Vault has no profile. On an account you may skip the profile step, though a name and a username are needed before Condei can show you to anyone, and you may remove your photo at any time.

2.5 Invitations

When you invite someone to a shared note or folder, you choose between their username (if they have a Condei account) and their email address.

• An invitation by email address. We store the address you typed, not encrypted, with the invitation, because without it we cannot send the email. The address belongs to someone who has not told us anything: we use it for that one invitation and, if you ask, one reminder a day at most, and for nothing else. We do not add it to a list and we do not email that person again unless you invite them again. It is deleted as soon as the invitation is accepted, declined, cancelled or expires after 14 days (section 7).
• The email. It is sent from account@condei.app through Mailgun (section 6), and says that you, by name and username, shared a note or folder with them. The email carries no images; the invitation page below also shows your profile photo. If you leave the "Include a preview in the email" switch on, which is its default, the email and the invitation page also show the note's title and the opening of its text (or the folder's name and how many notes it holds), and any message you wrote. If you switch it off, they say only that you shared something. A preview is plain text that leaves your end-to-end encryption on your say-so, goes to Mailgun, and sits in the email in the recipient's mailbox for as long as they keep it; we cannot take it back from there. Nothing else from the note is ever included.
• The invitation page. The link in the email opens a page at condei.app that asks our server for the invitation by its secret token. It needs no sign-in, is kept out of search engines, and shows only the sender's profile and, if you chose to include them, the preview and message. It never shows the invitee's address. Anyone who has the link can open it until the invitation is settled, so treat an invitation link like the email it came in.
• Limits. You can send 20 invitations a day, and each shared note or folder has room for three people besides you.

2.6 What the server can see about sharing

A shared note's content is encrypted on your devices with a key that only the people in the share hold, as with your own notes. What we can see, because our servers have to route it, is:

• that a share exists, who owns it, who is in it and with what role (read or edit), and who has been invited by account or by a pending email address;
• which of your items are in which share, and the sizes and times of every change to a shared note, in batches of about a tenth of a second while people are typing in it. That is how we deliver changes to the others, and it means we can see when people are working on a shared note together, though not what they write;
• who is currently in a shared note (presence), so the others can see it;
• that you mentioned a person in a shared note, and when. Mentions are written inside the encrypted note, but sending the notification means the author's device tells our server who to notify, and in which share;
• the name of a shared folder or note is not visible to us; it is sealed with the share's key.

None of this lets us read what the people write.

3. What is encrypted, and how

Every note, tag, folder and attachment is encrypted on your device with a key generated on your device. That master key is never sent to us in a form we can open. It is stored only as a set of wrapped copies, each openable by exactly one thing you have or know:

• your account password, if you set one;
• your recovery code, which we never see;
• a key held inside your device's secure hardware (Secure Enclave on Apple, StrongBox or the TEE on Android);
• a passkey, where your authenticator supports deriving a key from it.

Signing in proves who you are. It does not give us, or anyone who compromises us, the ability to decrypt anything. If Apple or Google were compromised and an attacker obtained a valid sign-in token for your account, they would get ciphertext and the metadata in section 4 — not your notes.

On Apple devices, your notes also sync between your own devices through your private iCloud database, still encrypted by us before iCloud sees them.

On Apple devices that use iCloud sync without a Condei account, a copy of the master key is placed in your iCloud Keychain so your other Apple devices can open the same notes. iCloud Keychain is itself end-to-end encrypted by Apple and we never see it, but the key does leave the device it was made on. Accounts do not use this route.

Android without a Condei account (Local Vault)

On Android you can use Condei without an account. Your notes are then kept on your phone, encrypted with a key that was made on it, and nothing about them is sent to us.

Google Drive backup. If you connect a Google account to back up your Local Vault, the app copies your notes, their history and their attachments into Condei's own hidden folder in that account's Google Drive (the "app data" folder, which the app can reach and nothing else in your Drive). What it uploads is already encrypted, and only your recovery code or your vault's key can open it: Google stores it but cannot read it, and it never passes through us. Google sees the encrypted files, their sizes and when they were written. You can turn the backup off, and delete older backups, in the app's backup settings.

Your vault's key in Google Block Store. So that a new phone signed in to the same Google account can open your Local Vault without the recovery code, the app also gives the vault's key — never your recovery code — to Google Block Store. Where your phone has a screen lock, Block Store backs that key up to your Google account end-to-end encrypted, under your screen lock, so Google cannot read it. Where it cannot do that, the key stays on the phone and moves only in a direct phone-to-phone transfer, and the app says so. Plainly: someone who controls your Google account and knows the screen lock of one of its phones could open the vault. The key is removed from Block Store when the vault is moved into a Condei account or deleted with the app's data.

Reminders

A reminder you set on a note is stored inside that note, encrypted like the rest of it. Each of your devices reads it from the decrypted note and schedules its own notification. That notification never passes through us, or through Apple's or Google's notification services, so Condei never learns whether you set a reminder, when, or how many. Setting, snoozing or finishing one does change the note, so, like any edit, it updates the note's last-changed time (section 4).

The notification is shown by your device, and by default it shows the note's title and first line on your lock screen. You can change that on each device in Settings → Notifications, under Reminder previews: Title only, or Hidden, which shows only "Condei reminder". A reminder on a locked note never shows the note's title, whatever you choose. Your device prepares each notification ahead of time, so until it rings, its text waits on that device, outside Condei's encryption.

On Android, so that reminders still ring after the phone restarts, the app also keeps each reminder's time and repeat setting, with the note's random identifier, in its own private storage on the phone. That copy is outside the encryption, but it never contains a note's title or text, is never sent to us, and is left out of Android's cloud backup.

Search on your device (Spotlight)

On iPhone, iPad and Mac, you can turn on Show Notes in Spotlight in Condei's settings. If you do, the titles and text of your notes, with their tags and the names of attached files, are kept in that device's own search index, so Spotlight and Siri on that device can find them. That copy is outside Condei's encryption. It is protected by your device, by its passcode or your Mac's login, not by Condei's lock. Condei never sends it to us or to Apple. A locked note is there by title only, and no pictures are added. Turning the setting off, or signing out, removes everything Condei put there. It is off unless you turn it on, and you choose separately on each device; the choice is not synced. The Android app adds nothing to the phone's own search.

The Home Screen widget

If you add Condei's Notes widget to your Home Screen, Condei keeps a small copy of what it draws there — your pinned, recent or chosen folder's note titles and short previews — so the widget can keep showing something after your phone restarts or Condei is not currently running. That copy is sealed with its own key, stored only on your device and never sent to us, separately from the key that protects the rest of your notes; unlocking your device once after a restart is enough for the widget to read it, and it is wiped the moment you sign out or remove the vault it belongs to (and, on Android, when you remove the last Condei widget). A locked note shows its title only, never its text. Hide note contents, in the widget's own settings, replaces every title and preview with a placeholder instead. The device the widget is on also briefly keeps what it last drew in its own cache, the way it does for any Home Screen widget, so this copy — like the ones described above for reminders and for search — is protected by your device rather than by Condei's lock.

On-device writing tools (Android)

On Android, Condei can proofread, rewrite, summarise or tidy a note using a language model built into your device through Google's ML Kit (Gemini Nano). This is off until you turn it on yourself, in Settings → General → On-device writing tools; while it is off, nothing described in this section happens — no model is downloaded and nothing reaches Google. The model always runs on your device: Condei never sends your notes, or any part of them, to a server for this feature. Turning the setting on does send Google technical information about each use — your device's maker, model and Android version, Condei's name and version, how long a request took, the size of the text going in and coming out (never the text itself), the language, and an identifier for this installation of Condei — so Google can run and maintain the model (section 6). You can review every result before it changes your note and undo it afterwards like any other edit, and you can turn the setting back off at any time.

On-device writing tools (Apple)

On iPhone, iPad and Mac, Condei can proofread, rewrite, summarise or tidy a note using language models built into your device and provided by Apple. These models run entirely on your device: nothing is sent to Condei, Apple's servers, or Apple's Private Cloud Compute. The writing tools are on by default on each device, so the feature is available the moment you open a note. You can turn them off in Settings → On-device writing tools; turning them off also hides Apple's system Writing Tools from the editor. Condei never logs or keeps the text you send to these tools. You can review every result before it changes your note and undo it afterwards like any other edit.

Sharing into Condei

On iPhone, iPad and Mac, what you share into Condei from another app waits on that device, sealed so that only the Condei app on that device can open it, until Condei files it into your notes, where it is encrypted like any other note. Nothing is sent anywhere first. Condei does not fetch the page you shared from. A link preview is made later, only if you have turned link previews on (section 6). On Android, what you share is filed straight into your notes once you unlock Condei; until then it is kept sealed on the phone, left out of backups, and deleted once it is filed or dropped.

4. The limits of end-to-end encryption

This is the section most privacy policies leave out. Encryption hides the contents of the container, not its shape. Specifically, we can see:

1. That you have an account, and which sign-in method it uses.
2. How many notes you have, roughly how large each one is, and how that changes over time. Sizes are padded so we see an approximate length, not an exact one — but a very long note is still visibly a long note.
3. When you write. Every item carries a last-changed time, to the millisecond. Over weeks, that is a reliable picture of when you are awake, when you work and when you are away.
4. Which device you write from, when each of your devices was last seen, whether it is registered for our notifications, and how its first-time setup ended.
5. Approximately where you are, from truncated network addresses at sign-in and sync time.
6. Your email address, unless you use Apple's private relay.
7. Which attachments belong to which note.
8. Who shares with whom. That a share exists, who is in it and in what role, which of your items it holds, and how often and how much its members change it, down to tenth-of-a-second batches while they type. If you invited someone by email, their address and, if you chose one, the preview and message until they are deleted (section 2.5, section 7). Not what a shared note says, nor its name.
9. Your profile name, username and photo, and who you have blocked, if you have set them. They are not encrypted, and section 2.4 says who is shown them.
10. Nothing about a future version of the app. End-to-end encryption is a property of the code running on your device. Any app that could be built to leak your keys would defeat it, and no server-side design can prevent that. This is true of every end-to-end encrypted product, Condei included.

Two more honest limits. Encryption cannot protect a device that is unlocked and compromised — while the app is unlocked, your notes are readable on that device. If you turn on Show Notes in Spotlight, your notes' titles and text stay findable in that device's search even while Condei is locked, though opening one asks you to unlock Condei first (section 3). If you add a Condei Notes widget, your pinned, recent or chosen folder's note titles and short previews are visible on your Home Screen without unlocking Condei at all, unless you turn on Hide note contents in the widget's own settings (section 3). And we do not currently detect a malicious version of our own server withholding or rolling back your items; we can see that risk and have not yet closed it.

5. Why we are allowed to process it (lawful basis)

We do not process your data for advertising, profiling or automated decision-making, and we do not sell it. We do not rely on consent for anything described above, so there is no consent to withdraw — you can stop the processing by deleting your account (section 8).

6. Who else is involved

Email to and from support runs on our own mail infrastructure; only the emails Condei sends go through Mailgun.

Reminders do not go through Apple's or Google's notification services. Your device schedules them itself (section 3).

The Spotlight search index, if you turn it on, stays on your device; Condei sends it to no one (section 3).

Websites your notes link to. If you turn on link previews (they are off unless you do), your devices fetch each linked page's title and picture directly from that website, never through us. That website sees the request as it would a visit: your full network address, the time, and — only if you choose "Device languages" for previews — your device's preferred languages. We are not involved in that request and never learn which links were fetched. The preview is saved inside the note, encrypted like the rest of it.

Our status page. status.condei.app is run for us by incident.io. If you visit it, incident.io sees your network address, as any website does. If you subscribe to updates there, incident.io holds your email address to send them, until you unsubscribe from a link in any update. The page is separate from your Condei account: we never post anything about individual accounts there. The alerts our servers send to our own monitoring (incident.io, Healthchecks.io and Slack) contain only counts and percentages, never an account, an email address or a network address.

7. How long we keep things

8. Deleting your account

You can delete your account from inside the app: Settings → Account → Delete account. It asks you to confirm by typing, and requires a recent, fully authenticated sign-in.

If you no longer have the app installed, you can ask us to delete your account from the web, without installing anything:

https://api.condei.app/account/delete

That page explains the in-app route first, then takes your email address and confirms by emailing you a link. Confirming files a deletion request, which we action through the same audited process as an in-app deletion. If your account has no email address we can match — some Apple and Google accounts do not — write to support@condei.app instead and we will verify you another way.

What happens when you delete:

• Immediately: every session is revoked, and your sign-in identities, your email address, your passkeys, your two-factor secret and backup codes, and your keybag are erased in the same transaction that marks the account deleted. Erasing the keybag destroys the only wrapped copies of your key, which makes every remaining copy of your encrypted data permanently unreadable — by us and by anyone else.
• Within 30 days: your items, attachments, devices and your own security activity are hard-deleted, and so are your profile name, username and block list. Until then they stay in your account's record but nobody can look you up by username any more. Your username is released at that point.
• Shares. If you own shares, they are deleted with your account, and the people in them lose access. If you are a member of someone else's share, you are removed from it, and their next change of key shuts you out of what comes after. A copy of a shared note that you made with Keep a Copy is yours and is not affected.
• Your profile photo: it stops being given to anyone as soon as the account is deleted, and the image file is deleted from storage when the account is hard-deleted in the same 30-day clean-up. If you want the photo gone sooner, remove it in the app, which asks our storage to delete the file at once.
• Kept: our internal record that staff acted on an account, which refers to the account only by an internal number and never contains your email address or anything else that identifies you. Section 9 explains why.
• Not ours to delete: on Apple devices, the copy in your own private iCloud database. The app deletes its own iCloud data when you delete your account, and tells you so.

Because deleting your account releases your sign-in identity immediately, you can sign up again straight away with the same Apple, Google or email sign-in.

If you only want to start over, the app can also reset your notes in place and keep your account — useful if you have lost every way to unlock your old notes. It permanently discards the old encrypted data, which nobody could have read anyway.

9. What our staff can see and do

Condei is operated by more than one person, so this is worth stating precisely.

Staff can find an account by its exact email address or account identifier, or browse a list of the accounts on the service, and open one to see what section 4 lists: status, sign-in methods, devices (including each device's setup record), sessions, security activity, item and attachment counts, storage used. They can sign your devices out, block a device, ask a device to show the first-time setup again, clear a lockout, change your storage allowance, suspend an account, export the metadata we hold, and delete an account. They can see which emails we sent to your account (which kind, when, and whether it was delivered) without seeing your address there. A senior member of staff can write to you directly, which is recorded in our staff record and in your security activity as "Condei support emailed this account"; and can send a service notice, such as planned maintenance, to every account, which a second senior person must approve first. Service notices are about the service itself, never marketing. Asking a device to show the setup again is recorded in our staff record and in your security activity, against that device, as "Condei support asked this device to show setup again".

The list of accounts exists so that staff can run the service without knowing in advance which account they are looking for. For each account it shows the same kind of thing as above and nothing more: the email address, whether the account is active, suspended or waiting to be deleted, when it was created, when it was last used, how many devices it has and how much storage it uses. It is shown a page at a time, can be narrowed by status, cannot be downloaded or exported, and cannot be searched by part of an address. Only named members of staff can use the admin console, each signing in with a passkey of their own, and only those whose job is supporting accounts can open an account or the list; the others see totals and the health of the service, never an individual account.

Staff can also see your profile name, your username and whether you have a photo, but not the photo itself and not your list of blocks. If a profile breaks our rules, they can reset the name, reset the username (it is then held for your account for 30 days) or remove the photo. Each of these is recorded in our staff record and in your security activity, and we email you.

They can also see how many shares you own and have joined, how many invitations you sent in the last day, and for each share who is in it and in what role. An invitation to an email address appears to them only as "an address": they cannot see the address, the preview or the message. They can suspend your ability to start sharing, which is recorded and emailed to you like any other staff action.

Staff can never read, decrypt or preview your notes or attachments, sign in as you, reset your password, "recover" your account, or edit your items. Those tools are not written, and the database account the admin console uses is not granted what they would need.

What staff do with an account is recorded permanently — who did it, when, what, and why — in an internal log that cannot be edited and is never deleted. That includes every time someone opens an account to look at it, which needs a reason typed in first and is recorded against that account, and every time someone browses the list of accounts, which records who, why, which part of the list and how many accounts it showed, never the addresses. The log refers to accounts by an internal number only, and holds no email addresses, so it carries nothing identifying once an account is gone. Finding an account by typing its exact email address or identifier is not recorded by itself: it only tells staff whether such an account exists, and nothing about it is shown until it is opened, which is recorded. Destructive actions taken through our admin console need a second senior person to approve them; the same actions taken from our server's command line do not, and that path is the only one that can produce a copy of your encrypted data.

You are told. Every action on your account is recorded in your security activity, which you can see any time in the app's Settings → Security activity screen or ask us for, and we also email you whenever our staff change something on your account. The only exception is where a court order forbids us from telling you — and the order itself is recorded.

10. Requests from courts, police and other authorities

We answer only where the law requires it. An export made through our admin console needs a second senior person to approve it; one made from our server's command line does not, and that is the path that produces encrypted data. Because your notes are end-to-end encrypted, all we can ever produce is the metadata in section 4 and encrypted data that we cannot read and neither can anyone who receives it. If we export anything, that export is recorded in your security activity, unless an order forbids us from telling you. The arrival of a request is not itself recorded, so you will not learn of one that we refuse.

11. Your rights

If you are in the UK or the EU, you have the right to ask for a copy of the personal data we hold about you, to have it corrected, to have it erased, to restrict or object to how we use it, and to receive it in a portable form. You also have the right to complain to a supervisory authority — in the UK, the Information Commissioner's Office (ico.org.uk); in the EU, the data protection authority of the country where you live.

If you are somewhere else, we give you the same rights as a matter of practice, not only where a law requires it: write to us and we will answer the request exactly as described below, regardless of where you live. This does not take away any right your own country's law separately gives you, and you may also have a local authority you can complain to.

How to ask: the quickest way to delete is in the app, or at https://api.condei.app/account/delete. For anything else, email support@condei.app.

What happens next: we check the request really comes from the account holder — usually by asking you to make it from inside the app, or from the email address on the account. We answer within one month. If a request is complex we may take up to two further months, and we will tell you within the first month if we are going to, and why.

What a copy of your data contains: the metadata in section 4, as a structured file, together with the identifiers your sign-in provider gave us, your devices' public keys and passkey details, your full security activity, and sessions you have already revoked. It cannot contain your notes in readable form, because we do not have the keys. Your notes in readable form live on your own devices. If you need an encrypted archive as well, we can produce one, but only your own key will open it.

12. Security

• Everything travels over TLS 1.3, with HSTS.
• Passwords never reach us. Your device derives two separate values from your password: one it sends to prove who you are, and one it never sends, which unwraps your key. We store only a slow hash of the first.
• Sign-in attempts, two-factor attempts and recovery attempts are rate limited per account and per network, and a burst of failures notifies you.
• Access tokens last 15 minutes. Refresh tokens rotate on every use, and if one is ever used twice we end that session, tell you, and send a security alert to your other devices that allow notifications.
• Two-factor secrets are encrypted with a key held outside the database.
• Adding a new device to your account requires either your recovery code or an approval on a device you already have, where both screens show the same six-digit code and you confirm they match.
• When a device asks to join your account or to open your locked notes, when a device is added, and when your recovery code is used, we send an alert to your other devices that allow notifications. These alerts never contain your notes.

If we become aware of a personal data breach that is likely to be a risk to you, we will notify the relevant supervisory authority within 72 hours where required and tell you without undue delay where the law requires it. To report a vulnerability, email support@condei.app.

13. Children

Condei is not directed at children and we do not knowingly collect personal data from anyone under 16. If you believe a child has an account, email support@condei.app and we will delete it. Because the contents of notes are encrypted, we cannot and do not scan them to estimate a user's age.

14. International transfers

Our servers are hosted by Hetzner in Germany, and your encrypted attachments are stored by Cloudflare in its European Union jurisdiction. Condei's own database, attachment storage and backups never leave the European Union.

The only data that goes further is what reaches Apple or Google when you sign in with them, when the app asks them to confirm it is genuine, when we send a notification to your device through them, when you buy Condei Nor from their store, when your Apple devices sync through your own iCloud account, or when your Android Local Vault is backed up to your own Google Drive and Block Store, or when you visit or subscribe to our status page, which incident.io runs (section 6). Those transfers rely on the EU–US Data Privacy Framework where the receiving company is certified under it, and on the European Commission's Standard Contractual Clauses where it is not.

If you use Condei from outside the UK and the EU/EEA (Condei is offered everywhere the App Store and Google Play sell it, except France — Terms of Service section 2), your data is still processed exactly as this policy describes, by the same servers in Germany and the same processors in section 6, regardless of where you are. Sending it there and back to you is an international transfer either way; we protect it with the same technical and contractual safeguards for every user, not a reduced set for users outside the UK and EU/EEA.

15. Changes to this policy

If we change anything material, we will say so in the app and update the effective date above. Continuing to use Condei after a change means the new version applies.

16. Contact

Email: support@condei.app