What Condei is
Condei is a notes app for iPhone, iPad, Mac and Android. Notes, titles, tags, folders and attachments are encrypted on your device before they leave it, and we hold only the encrypted copies. We do not hold the keys, so nobody at Condei can read your notes.
Notes are written in Markdown, stored on your device, and synced between your devices — natively through your own private iCloud database between Apple devices, and through our server for Android and for syncing across the two worlds.
For what encryption does and does not hide, see the Privacy Policy, section 4.
Getting started
Why does Condei insist on a recovery code?
Because for most accounts it is the only way back in if you lose your devices.
Your notes are locked with a key that exists only on your devices. That key is wrapped separately by each thing that can open it: your password (if you have one), your recovery code, each of your devices' secure hardware, and a passkey where your authenticator supports it. Signing in with Apple or Google proves who you are — it does not produce a key. So an Apple- or Google-only account with no recovery code and no second device has no offline way back to its notes.
The code is 26 characters, shown as CNDI-XXXXXX-XXXXX-XXXXX-XXXXX-XXXXX. Setup asks you to re-type two of its groups before it will finish. Save it in a password manager.
Adding a second device
Sign in on the new device, then choose Approve from another device. Both screens show the same six-digit code; check they match, then approve on the device you already have. It takes under a minute and you never type the recovery code.
If no other device is to hand, choose Use your recovery code instead.
On Apple devices, a second Apple device usually finds the key in your iCloud Keychain and needs no approval at all. On Android, the equivalent (Google Block Store) is on by default and can be switched off in Settings.
Common questions
I forgot my recovery code
If you still have a device that is signed in, or you know your account password, nothing is lost. Do this now, from that device:
- Open Settings → Security and create a new recovery code.
- Save it somewhere you will find it.
Creating a new code replaces the old one — the old one stops working immediately. There is no "view my code" anywhere, on your device or on our servers: the code was shown once and never stored, so the only option is to make a new one.
If you have no unlocked device and no password either, read the next two answers.
I lost my only device
What you can do depends on what you still have:
| What you still have | What you can do |
|---|---|
| Your recovery code | Sign in, unlock everything, and set a new password if you want one |
| Another device that is still signed in | Approve the new device from it, unlock everything |
| Only your password | Sign in and unlock everything |
| Only access to your email | Reset your sign-in password. Your existing notes stay locked |
| None of the above | Your notes cannot be recovered |
The fourth row is the one that surprises people. Resetting your password lets you sign in again, but a new password cannot unwrap a key that was wrapped with the old one. Your old notes stay on the device as encrypted items, shown as "N notes locked", and the app keeps them rather than deleting them. If your recovery code turns up in a drawer six months later, they all come back.
Can support recover my notes?
No. This is not a policy we could be persuaded to bend — the capability does not exist. There is no database query, no admin setting and no identity check that produces a readable note, because we have never held a key that opens one. Anyone who tells you otherwise, including someone claiming to be us, is not us.
If every way in is gone, the app offers to start a fresh vault: it keeps your account, sign-in and email address, and discards the old encrypted data, which nobody could have read anyway. It asks you to type a confirmation first, and it gives you a new recovery code.
How do I delete my account?
In the app: Settings → Account → Delete account. You will be asked to re-authenticate and to type a confirmation.
Without the app: https://api.condei.app/account/delete. It emails you a link to confirm.
What is erased and when is in Delete your account.
A note disappeared — can I get it back?
Deleted notes sit in Trash for 30 days and can be restored from there. After 30 days your app removes them for good, and the record of the deletion is kept on our server for another 30 days only so that your other devices learn about it. Once that passes, the note is unrecoverable.
What is a "conflicted copy"?
If the same note is edited on two devices before they have synced with each other, Condei keeps both. The newer edit stays as the note, the older one is filed beside it with (conflicted copy — <device>, <date>) in the title, and you decide what to keep. Nothing is silently overwritten.
Our server cannot merge the two, even in principle — it only ever sees ciphertext. Any merging has to happen on your device, after decryption. A conflicted copy your apps have not picked up is held for 90 days.
How much can I store?
| Limit | Value |
|---|---|
| Storage per account | 5 GiB |
| Single attachment | 100 MiB |
| Attachments per note | 100 |
| One note's text | about 1 MiB |
When you hit your storage quota, new uploads are refused with a quota error and everything already synced stays exactly as it is — nothing is deleted to make room. Free space by deleting notes or attachments. A note that is too large to sync is rejected on its own, and the rest of that sync still succeeds; move the bulk of it into an attachment.
Condei has no paid tier at the moment, so there is no subscription to run out and no upgrade to buy. If that changes we will say so before it affects you.
Why does the app show where I signed in from?
So you can spot a session that isn't yours. Under Settings → Security activity you can see each sign-in, the device it came from and an approximate place like "near London". We store only a truncated network address — never the full one — and the place is looked up from a database on our own server, so nothing about you is sent to a third party to produce it.
From the same screen you can sign out a single session, sign out everything else, or remove a device.
Someone added a device to my account and I didn't do it
Removing that device from Settings → Security revokes its sessions and its ability to unlock in future. But removing a device does not reach back and erase the key from a device that already has it. If you think a device was genuinely compromised, rotate your master key from a device you trust: it re-keys the account, signs every other device out, and gives you a new recovery code. Anyone holding the old key can still read what they already had, and nothing new.
Do the same if your recovery code has leaked.
Does Condei work offline?
Yes. Your notes live on your device; syncing is what happens on top. Edits made offline sync when you reconnect.
What about two-factor authentication?
Available for email-and-password accounts: an authenticator app (TOTP) plus ten single-use backup codes. A passkey sign-in already counts as two factors, so it does not ask for a separate code.
Backup codes are not your recovery code. They get you past the two-factor prompt at sign-in. They do not unlock your notes. The recovery code does the opposite — it unlocks your notes and is not a sign-in code. Keep them apart.
Getting in touch
support@condei.app — for anything, including a bug, a data request, or a security issue.
Please include your platform and app version, and what you were doing. Do not send your recovery code, your password, or a backup code to anyone, including us: we never need them and cannot use them.
We answer data-protection requests (a copy of your data, correction, deletion) within one month, and will tell you within that month if a complex request needs longer.