1. The short version
Condei is a notes app. Your notes, their titles, your tags, your folders and your attachments are encrypted on your device before they leave it. We hold the encrypted copies. We do not hold the keys, so we cannot read them — not to help you, not to moderate them, not because someone asked us to.
Encryption hides what you write. It does not hide that you have an account, how many notes are in it, roughly how big they are, or when you last changed one. We can see that, and section 4 lists all of it plainly.
2. What we collect
2.1 Things you give us
| What | Why | Where it comes from |
|---|---|---|
| Your email address | To identify your account, send security notices and answer you | You, when you sign up — or Apple's private relay address if you use Sign in with Apple and hide your address |
| Your sign-in credentials | To let you sign in | A password (we store only a hash of a value derived from it — never the password), a passkey's public key, or an Apple/Google account identifier |
| Two-factor settings | To protect your account | Your TOTP secret (stored encrypted) and hashes of your backup codes, if you turn 2FA on |
| Device names | So you can recognise your own devices in the app and approve new ones | A label you or your device supplies, e.g. "Pixel 9 Pro" |
| Your notes, tags, folders and attachments | To sync them between your devices | Encrypted on your device. We receive ciphertext only |
2.2 Things our servers record because they have to
| What | Why |
|---|---|
| A truncated network address for each sign-in and sync (a /24 or /48 prefix, never the full address) | Rate limiting, abuse prevention and showing you where a session signed in from |
| The approximate place that prefix maps to, e.g. "near London" | So you can spot a session that isn't yours. Looked up from a database on our own server; nothing is sent to anyone else |
| When each item was created and last changed, to the second | Sync needs it to decide what to send you |
| How many items you have, and their type (note, tag or folder) | Sync and storage accounting |
| The size of each encrypted item and attachment, and your total storage | Storage quotas |
| Which attachment belongs to which note | Storage accounting and clean-up. This is the one relationship our database stores in the clear; everything else about how your notes are organised is inside the encryption |
| Your device list: platform, the label, public keys, whether keys are hardware-backed, when last seen | Sync, key transfer to a new device, and your device list in the app |
| Session records: when you signed in, when tokens were refreshed, a hash of the app's user-agent | Security, and the session list you can review and revoke |
| Push notification tokens (Apple's APNs, Google's FCM) | To notify you when a new device asks to join your account |
| Your security activity: sign-ins, failed sign-ins, devices added and removed, key transfers, recovery-code use, password changes and so on | So you can see them under Settings → Security activity |
2.3 What we do not collect
- We do not collect your name. If Apple sends it to us on your first sign-in, we read it and throw it away; your account is keyed on Apple's identifier.
- We do not store full IP addresses in our database. They are truncated at the door, before anything logs them.
- We do not store the contents of requests to our sign-in endpoints; they are redacted from our logs, along with authorisation headers, refresh tokens and password-derived secrets.
- We do not have, and cannot obtain, your master key, your recovery code, or any decrypted note.
3. What is encrypted, and how
Every note, tag, folder and attachment is encrypted on your device with a key generated on your device. That master key is never sent to us in a form we can open. It is stored only as a set of wrapped copies, each openable by exactly one thing you have or know:
- your account password, if you set one;
- your recovery code, which we never see;
- a key held inside your device's secure hardware (Secure Enclave on Apple, StrongBox or the TEE on Android);
- a passkey, where your authenticator supports deriving a key from it.
Signing in proves who you are. It does not give us, or anyone who compromises us, the ability to decrypt anything. If Apple or Google were compromised and an attacker obtained a valid sign-in token for your account, they would get ciphertext and the metadata in section 4 — not your notes.
On Apple devices, your notes also sync between your own devices through your private iCloud database, still encrypted by us before iCloud sees them. On Android, you can optionally keep an encrypted backup in your own Google Drive app-data folder.
4. The limits of end-to-end encryption
This is the section most privacy policies leave out. Encryption hides the contents of the container, not its shape. Specifically, we can see:
- That you have an account, and which sign-in method it uses.
- How many notes you have, roughly how large each one is, and how that changes over time. Sizes are padded so we see an approximate length, not an exact one — but a very long note is still visibly a long note.
- When you write. Every item carries a last-changed time, to the second. Over weeks, that is a reliable picture of when you are awake, when you work and when you are away.
- Which device you write from, and when each of your devices was last seen.
- Approximately where you are, from truncated network addresses at sign-in and sync time.
- Your email address, unless you use Apple's private relay.
- Which attachments belong to which note.
- Nothing about a future version of the app. End-to-end encryption is a property of the code running on your device. Any app that could be built to leak your keys would defeat it, and no server-side design can prevent that. This is true of every end-to-end encrypted product, Condei included.
Two more honest limits. Encryption cannot protect a device that is unlocked and compromised — while the app is unlocked, your notes are readable on that device. And we do not currently detect a malicious version of our own server withholding or rolling back your items; we can see that risk and have not yet closed it.
5. Why we are allowed to process it (lawful basis)
| What | Basis |
|---|---|
| Storing and syncing your encrypted notes, running your account | Performance of our contract with you (our Terms of Service) |
| Rate limits, abuse prevention, sign-up integrity checks, security logging | Our legitimate interest in keeping the service available and other people's accounts safe |
| Security emails about your own account | Performance of the contract, and our legitimate interest in your account's security |
| Answering data-protection and lawful requests, keeping the record of them | Legal obligation |
We do not process your data for advertising, profiling or automated decision-making, and we do not sell it. We do not rely on consent for anything described above, so there is no consent to withdraw — you can stop the processing by deleting your account (section 8).
6. Who else is involved
| Who | What they do | What they see |
|---|---|---|
| Hetzner | Hosts our server and database, in Germany | The encrypted data and the metadata in section 4, at rest on their hardware |
| Apple | Sign in with Apple; push notifications (APNs); iCloud sync between your own Apple devices; sign-up integrity checks (App Attest) | Your Apple identifier and, if you use it, your relay address. iCloud sees the same ciphertext we do |
| Sign in with Google; push notifications (FCM); sign-up integrity checks (Play Integrity); optional Drive backup, if you turn it on | Your Google identifier. Drive sees the same ciphertext we do | |
| MaxMind | Supplies the offline database we use to turn a truncated address into "near London" | Nothing. The database runs on our own server; no lookup leaves it |
Email to and from support runs on our own mail infrastructure.
7. How long we keep things
| What | How long |
|---|---|
| Your encrypted notes and attachments | Until you delete them, or you delete your account |
| A deleted note's record of deletion (so your other devices learn about it) | 30 days, then permanently removed |
| A conflicting copy your apps have not yet picked up | 90 days |
| A device you have not used | 90 days of inactivity before it stops holding back clean-up |
| Web server access logs | 14 days |
| Your account's security activity | 12 months |
| Our internal record of staff actions | Indefinitely — see section 9 |
| An email address you gave us to answer a data or deletion request | 30 days after that request is closed, then deleted |
| Your account after you ask us to delete it | See section 8 |
8. Deleting your account
You can delete your account from inside the app: Settings → Account → Delete account. It asks you to confirm by typing, and requires a recent, fully authenticated sign-in.
If you no longer have the app installed, you can ask us to delete your account from the web, without installing anything:
https://api.condei.app/account/delete
That page explains the in-app route first, then takes your email address and confirms by emailing you a link. Confirming files a deletion request, which we action through the same audited process as an in-app deletion. If your account has no email address we can match — some Apple and Google accounts do not — write to support@condei.app instead and we will verify you another way.
What happens when you delete:
- Immediately: every session is revoked, and your sign-in identities, your email address, your passkeys, your two-factor secret and backup codes, and your keybag are erased in the same transaction that marks the account deleted. Erasing the keybag destroys the only wrapped copies of your key, which makes every remaining copy of your encrypted data permanently unreadable — by us and by anyone else.
- Within 30 days: your items, attachments, devices and your own security activity are hard-deleted.
- Kept: our internal record that staff acted on an account, which refers to the account only by an internal number and never contains your email address or anything else that identifies you. Section 9 explains why.
- Not ours to delete: on Apple devices, the copy in your own private iCloud database. The app deletes its own iCloud data when you delete your account, and tells you so.
Because deleting your account releases your sign-in identity immediately, you can sign up again straight away with the same Apple, Google or email sign-in.
If you only want to start over, the app can also reset your notes in place and keep your account — useful if you have lost every way to unlock your old notes. It permanently discards the old encrypted data, which nobody could have read anyway.
9. What our staff can see and do
Condei is operated by more than one person, so this is worth stating precisely.
Staff can look up one account at a time by exact email address or account identifier and see what section 4 lists: status, sign-in methods, devices, sessions, security activity, item and attachment counts, storage used. They can sign your devices out, block a device, clear a lockout, change your storage allowance, suspend an account, export the metadata we hold, and delete an account.
Staff can never read, decrypt or preview your notes or attachments, sign in as you, reset your password, "recover" your account, or edit your items. Those tools are not written, and the database account the admin console uses is not granted what they would need.
Every staff action is recorded permanently — who did it, when, what, and why — in an internal log that cannot be edited and is never deleted. It refers to accounts by an internal number only, and holds no email addresses, so it carries nothing identifying once an account is gone. Destructive actions need a second senior person to approve them.
You are told. Every action on your account appears in the app under Settings → Security activity, and we will email you about it once email sending is switched on. The only exception is where a court order forbids us from telling you — and the order itself is recorded.
10. Requests from courts, police and other authorities
We answer only where the law requires it, and a second senior person must approve before anything is handed over. Because your notes are end-to-end encrypted, all we can ever produce is the metadata in section 4 and encrypted data that we cannot read and neither can anyone who receives it. We tell you about such a request unless an order forbids it.
[IF A TRANSPARENCY REPORT IS PUBLISHED:] We publish counts of the requests we receive and how we responded.
11. Your rights
If you are in the UK or the EU, you have the right to ask for a copy of the personal data we hold about you, to have it corrected, to have it erased, to restrict or object to how we use it, and to receive it in a portable form. You also have the right to complain to a supervisory authority — in the UK, the Information Commissioner's Office; in the EU, your national authority (ANSPDCP, Romania's National Supervisory Authority for Personal Data Processing).
How to ask: the quickest way to delete is in the app, or at https://api.condei.app/account/delete. For anything else, email support@condei.app.
What happens next: we check the request really comes from the account holder — usually by asking you to make it from inside the app, or from the email address on the account. We answer within one month. If a request is complex we may take up to two further months, and we will tell you within the first month if we are going to, and why.
What a copy of your data contains: the metadata in section 4, as a structured file. It cannot contain your notes in readable form, because we do not have the keys. Your notes in readable form live on your own devices. If you need an encrypted archive as well, we can produce one, but only your own key will open it.
12. Security
- Everything travels over TLS 1.3, with HSTS and certificate pinning in the mobile apps.
- Passwords never reach us. Your device derives two separate values from your password: one it sends to prove who you are, and one it never sends, which unwraps your key. We store only a slow hash of the first.
- Sign-in attempts, two-factor attempts and recovery attempts are rate limited per account and per network, and a burst of failures notifies you.
- Access tokens last 15 minutes. Refresh tokens rotate on every use, and if one is ever used twice we end that session, tell you, and notify your other devices.
- Two-factor secrets are encrypted with a key held outside the database.
- Adding a new device to your account requires either your recovery code or an approval on a device you already have, where both screens show the same six-digit code and you confirm they match.
- Your other devices are told whenever a device is added, a key is transferred, your recovery code is used or rotated, or your master key is rotated.
If we become aware of a personal data breach that is likely to be a risk to you, we will notify the relevant supervisory authority within 72 hours where required and tell you without undue delay where the law requires it. To report a vulnerability, email support@condei.app.
13. Children
Condei is not directed at children and we do not knowingly collect personal data from anyone under 13. If you believe a child has an account, email support@condei.app and we will delete it. Because the contents of notes are encrypted, we cannot and do not scan them to estimate a user's age.
14. International transfers
Our servers are hosted by Hetzner in Germany. Where your data reaches Apple or Google — for sign-in, push notifications, integrity checks, iCloud or Drive — it may be processed outside that region under those companies' own terms and transfer safeguards. [TRANSFER MECHANISM — e.g. UK IDTA / EU Standard Contractual Clauses, to be confirmed by a lawyer.]
15. Changes to this policy
If we change anything material, we will say so in the app and update the effective date above. Continuing to use Condei after a change means the new version applies.
16. Contact
Email: support@condei.app
Data protection contact: [DPO or CONTACT]
Postal: Cristian Scutariu, Romania