End-to-End Encrypted

Security & Privacy

Your notes are yours alone. Learn how FlowNote protects your data.

Last updated: November 2025

The Simple Version

Imagine you have a secret diary that only you can read because it's locked with a special key that only you possess.

When you save a note

Your phone locks the note with your secret key. The locked note is stored in the cloud. Even if someone breaks into the cloud, they just see scrambled nonsense.

When you search

Your phone creates secret "stickers" for each word. These stickers can't be reversed to reveal the original words. Our server matches stickers without ever knowing what words they represent.

The result: You get the convenience of cloud sync and search, but your actual notes remain completely private.

Encryption Specification

CipherAES-256-GCM

Key Size256-bit

IV Length96-bit (12 bytes)

Auth Tag128-bit

Key DerivationPBKDF2-SHA256, 100k iterations

Key Storage

Your encryption key is generated and stored locally using platform-native secure storage:

iOS: Stored in the Secure Enclave via iOS Keychain
Android: Stored in Android Keystore (hardware-backed when available)

The key never leaves your device in unencrypted form.

What Gets Encrypted

When you create a note, all sensitive data is encrypted together as a single blob before leaving your device:

Your transcript text
Categories and tags
List items and checklist data
Note metadata

What Our Servers See

Note contentEncryptedRandom bytes

CategoriesEncryptedRandom bytes

List itemsEncryptedRandom bytes

Search indexHashedIrreversible tokens

TimestampsVisibleWhen notes were created

File sizesVisibleBlob size in bytes

Searchable Encryption

One of the hardest problems in encryption: how do you search encrypted data without decrypting everything?

FlowNote solves this with a blind index - a technique that allows searching without exposing your data.

How It Works

Tokenization: When you save a note, your device breaks the text into words
Hashing: Each word is converted to an HMAC digest using a key only your device has
Indexing: These digests are stored on our server
Searching: When you search, your device hashes your query words
Matching: Our server matches digests without knowing what words they represent

Example

Your note: "Buy groceries tomorrow"

Your device creates:
  "buy" → "Ax7f9kL2..."
  "grocery" → "Bm3pQ8z1..."
  "tomorrow" → "Cn5rT4w9..."

Server stores: ["Ax7f9kL2...", "Bm3pQ8z1...", "Cn5rT4w9..."]

When you search "groceries":
  Your device sends: "Bm3pQ8z1..."
  Server returns: "Note #42 matches"
  Your device decrypts Note #42

The server never sees "buy", "groceries", or "tomorrow" - only meaningless hashes.

Key Backup & Recovery

Your encryption key is stored only on your device. If you lose your device without a backup, your notes cannot be recovered - by you or by us.

How Backup Works

You create a backup password (we recommend 12+ characters)
Your device derives a backup key using PBKDF2 (100,000 iterations)
Your master key is encrypted with this backup key
The encrypted key blob is stored on our servers

We cannot decrypt your backup without your password. If you forget your password, your backup is useless.

What We Cannot Do

Because of how FlowNote is designed, we are technically unable to:

Read your notes
Search through your notes
Know what categories you use
See your list items
Provide your notes to third parties

This isn't a policy choice - it's a technical reality.

Threat Model

What We Protect Against

Database breachProtected

Rogue employeeProtected

Network interceptionProtected

Server compromiseProtected

Limitations

Device theft (unlocked)Limited

Malware on your deviceLimited

Weak backup passwordLimited

Forgetting your passwordUnrecoverable

AI Features & Privacy

FlowNote offers optional AI features (categorization, search enhancement, pre-read summaries).

Privacy Measures

Opt-in: All AI features can be disabled in settings
Minimal data: We send only what's necessary (e.g., first 500 characters for re-ranking)
No training: Your notes are never used to train AI models
Your own key: You can use your own Google AI API key for complete control

Frequently Asked Questions

Can FlowNote read my notes?

No. Your notes are encrypted on your device before being sent to our servers. We don't have the encryption key.

What happens if FlowNote gets hacked?

Attackers would get encrypted blobs that are computationally infeasible to decrypt without your key.

What if I forget my backup password?

Your notes on existing devices will still work. However, you won't be able to access notes on new devices, and if you lose all your devices, your notes are unrecoverable.

What encryption library do you use?

iOS uses Apple's CryptoKit (AES-GCM). Android uses the Android Keystore + Cipher API. Backend uses Node.js crypto module.

Security concerns? Contact us at security@tryflownote.com

For responsible disclosure of security vulnerabilities, please email us directly rather than posting publicly.