Security
Your records should
outlive the app.
Research records and team decisions are irreplaceable. Here is plainly what we store, where, how we protect it, and how you take it with you.
Where your data lives
- ServerThe database and attachments are stored on a dedicated virtual server in Oracle Cloud's Osaka region (Japan).
- In transitAll traffic is encrypted with HTTPS (TLS). Browsers refuse plain HTTP on
.appdomains, and our HSTS header enforces it again. - No ads, no trackingNo advertising identifiers, tracking pixels or third-party analytics — including on this website.
- What leaves the serverOnly what a feature needs (email delivery, payments, push, weather), and only when you use it. The full list of recipients is in the Privacy Policy.
Account protection
- PasswordsNever stored in plain text — hashed with scrypt, irreversibly.
- SessionsSessions and one-time tokens are stored only as hashes, so a leaked database cannot be used to sign in.
- PasskeysSign in with Face ID or Touch ID instead of a password.
- Sign-in alerts and devicesWe email you about sign-ins from new devices; the Security screen lists active devices so you can end them.
- Re-authenticationHard-to-undo actions, such as changing your recovery email or deleting the account, ask for your password again.
- Note and notebook locksLock sensitive records with a separate password so someone borrowing your signed-in screen cannot open them.
Application protection
- Content Security PolicyOnly scripts from our own origin run. Scripts hidden in pasted HTML or imported files are refused by the browser.
- Cross-site request blockingWrite requests sent by other sites on your behalf are rejected by an origin check.
- One gate for permissionsNote, notebook and team permissions are decided at a single gate used by every API call and live-editing connection.
- Email confirmationNew accounts open only after you press the confirmation button in the sign-up email. The link is processed only on that press, so mail scanners that open links cannot use it up.
Backups and recovery
- Encrypted backups every six hoursThe full database and attachments are encrypted on our server before upload to Google Drive. Only the operator holds the key, so Google cannot read them. A separate encrypted offline copy is also kept.
- Restore drillsEvery week a backup is actually restored and checked for missing files.
- Version historyNotes are snapshotted periodically while you edit, and immediately if content drops sharply. Roll back any time.
- 30-day trashDeleted notes can be restored from the trash for 30 days.
- Public uptimeAn external monitor checks every five minutes; uptime and incidents are public on the status page.
Your data is yours
- Export any timeA note as Markdown, HTML or PDF; the whole workspace as a ZIP.
- Delete your account in the appUse Delete account at the bottom of the Account screen. Account details such as email and display name are erased at once. Usernames inside notes that stay with a team, and how long encrypted backups keep data, are set out in the Privacy Policy.
- Record sealing and signaturesSealing an experiment record stores a hash of its content, proving it has not changed since that day.
Found a vulnerability?
Please tell us before disclosing: k2dydwl@gmail.com. Include reproduction steps and impact; we will confirm and reply. Please do not access other users' data or disrupt the service while testing. Our contact is also in security.txt.