Privacy

The server cannot read your notes

Your browser makes the keys. It encrypts each note before it sends the note. Your passphrase makes a key with PBKDF2 (600000 rounds). That key protects a random vault key. The vault key locks each note with AES-GCM. Your passphrase and your keys never leave your browser.

What the server stores

• Your email, to know whose notes they are.
• Your vault: a random salt, the number of PBKDF2 rounds and your vault key, locked with your passphrase. Without your passphrase it is not readable.
• Each note as encrypted data, with its size, a version number and the times it was made and changed.
• Each share link of a note: the encrypted snapshot, the time you made it and your email.

The server never stores these items:

• Your passphrase or your vault key.
• The key of a share link.
• The title or the text of a note, in a form it can read.

Share links

A share link looks like /n/ID#KEY. The part after the # sign is the key. Browsers never send that part to a server. Anyone who has the whole link can read the note. Send it only to people you trust.

A link shows a snapshot: the note as it was when you made the link. Later changes do not show. A link does not end by itself. You delete it, or you delete the note. Then it stops working at once.

The server cannot show you a link again, because it does not have the key. Copy the link when you make it.

Pictures in Markdown are not loaded, so a note cannot tell another site that you read it. Links in a note open in a new tab and send no referrer.

In your browser

The vault key stays in the memory of the page. It is never written to localStorage, sessionStorage or IndexedDB. A reload, a closed tab, the Lock button, signing out, or 15 minutes with no input removes it. Then you type your passphrase again.

The files you download are not encrypted. Keep them in a safe place.

If you lose your passphrase

Your notes are gone. Nobody can get them back. Not even we can. You can delete everything and start again with a new passphrase.

How long it stays

Your data stays until you delete it. You can delete a note, a share link, or all your data. Deleting a note also deletes its share links.

Delete my account

Sign in and choose "Delete my account". The server then deletes all your notes, your share links and your vault. It also deletes your sign-in account. This cannot be undone.

Your sign-in is shared with Kevin's other apps. So you are signed out of them too. A request goes to Kevin automatically. He deletes what those apps keep for your account soon after.

Signing in

To sign in you use Google (on Google's site) or a code sent to your email. The sign-in service keeps your email and sets a cookie on utilarium.app (and on kamadorueda.com when the sign-in goes through it) for 30 days. For details, read the sign-in section of Coro's privacy page.

Where it runs

Secure notes runs on Cloudflare. The records are in Cloudflare D1. Like any web host, Cloudflare sees your IP address and the page you ask for. To limit how many share links one address can make, Cloudflare counts requests by address. We do not store or log the address.

Analytics and error reports

Cloudflare Web Analytics can add a small script to the pages, to measure visits and speed. We do not control that script. Our own code sets no cookie and keeps no profile of you.

If the page has an error, it sends a report with the error message, page type and browser. It has no note, title, key or email. Cloudflare keeps technical request logs, with no IP address, for 7 days. For about 1 in 10 requests, Cloudflare also records the browser and operating system, the language, the network and an approximate location. These records hold no note and no key.