Joplin is an open-source, local-first note-taking app for desktop, mobile and terminal, created by Laurent Cozic and licensed under AGPL-3.0. Notes are stored on the user's own device and no account is required for local use; the project publishes a privacy page enumerating every network connection the apps make. Sync is optional, to self-hosted targets, third-party storage (OneDrive, Dropbox, WebDAV) or the paid Joplin Cloud service operated by JOPLIN, a French SAS (RCS Nancy 919 395 087) subject to GDPR. End-to-end encryption is supported on all apps but is opt-in, so sync targets can read note content by default. Sentry crash reporting is off by default, though update checks and note geo-location are on by default. Its E2EE got an informal third-party review in 2020; the desktop app has had published XSS-to-code-execution flaws.
TIMELINE
NO ENTRIES ON FILE YET.
TOOLS WE RECOMMEND
PLUS
RECEIPTS
17 ON FILE
COLLECTION
The Joplin Privacy Policy states that the Android, iOS, Windows, macOS and Linux applications do not send any data to any service without the user's authorisation and that notes and images are saved to the user's own device; however, it also discloses that geo-location is saved into note properties by default, for which the app connects to ipwho.is or geoplugin.net (this can be disabled in settings).
The Joplin Cloud Privacy Policy states the service stores only email (required), full name (optional), synchronisation items, and Stripe user/subscription IDs, with financial information processed by Stripe and not stored; disabled accounts are automatically deleted after 100 days, and user information is removed within 92 days of account deletion then archived a further 90 days for legal reasons.
Joplin publishes an official warrant canary — a regularly updated, cryptographically signed statement hosted in its GitHub repository and documented on joplinapp.org — indicating that no secret legal orders or gag orders have been received as of the stated date, with a published signing-key rotation policy.
The Joplin Cloud terms and conditions identify JOPLIN as the owner of the Joplin Cloud service, with registered office at 3 Place Simone Veil, CS 20739 54064 Nancy, France, registration SIREN RCS Nancy 919 395 087, and state that use of the website is subject to the laws of France.
The French government company register (recherche-entreprises.api.gouv.fr, drawing on INSEE/INPI data) records JOPLIN (SIREN 919 395 087) as an active société par actions simplifiée (SAS) created on 2022-09-09, with founder Laurent Cozic listed as Président de SAS and principal activity computer programming (NAF 62.01Z).
In a project announcement dated 2022-12-21, Joplin stated it was switching the desktop, mobile and CLI applications and the web clipper to the GNU Affero General Public License v3 (AGPL-3.0), keeping the applications open source while requiring forks to share changes back.
The Joplin Cloud Privacy Policy states that personal data is treated confidentially and will not be shared with any third party, that GDPR applies as the legal basis for processing, and that the only named external processor is Stripe for payments.
Joplin's end-to-end encryption documentation states that E2EE is supported on all applications but must be manually enabled by the user on a first device and then synced to the others; it is not enabled by default, so in the default configuration the sync target (Joplin Cloud or a third-party service such as OneDrive or Nextcloud) receives unencrypted note content.
Joplin publishes a security policy in its main repository that routes vulnerability reports through GitHub's private vulnerability reporting channel with a required proof of concept, and defines scope by explicitly listing areas outside its threat model — denial of service, physically-local attacks, compromised machines, opening local files, DLL sideloading, and unencrypted local data — citing Chromium's security FAQ for each exclusion. The policy states that no monetary bounty is offered.
In a post published 2020-04-06, Joplin disclosed the results of an informal audit of its encryption and E2EE sync system by Isaac Potoczny-Jones, CEO of security firm Tozny, who found no critical issues but identified weaknesses — including use of the OCB2 cipher mode — after which Joplin completed migration of all clients to the more secure CCM mode and shipped a re-encryption tool.
The U.S. National Vulnerability Database entry for CVE-2022-35131, published 2022-07-25, records a critical (CVSS 3.1 base score 9.0) vulnerability in Joplin desktop v2.8.8 allowing arbitrary command execution via a crafted payload injected into note titles — one of several published XSS-to-code-execution vulnerabilities in the Electron-based desktop app that have been fixed via public advisories.
The GitHub Advisory Database entry GHSA-ww2v-frv5-pj5x, published 2022-07-26, records that CVE-2022-35131 — the critical arbitrary-command-execution issue in Joplin desktop already noted in this dossier — was remediated in Joplin 2.9.1, with the advisory referencing the v2.9.1 release tag as the fix.
In a post dated 2023-10-23, Joplin documented its coordinated vulnerability-handling process — a security researcher emails a reproduction, the team examines the issue, ships a fix with automated regression tests, shares the fix with the researcher for validation, and backports it to earlier versions depending on severity — and publicly credited 14 named security researchers who had reported vulnerabilities over the years.
Joplin announced its warrant canary in a post dated 2026-02-23, committing to a signed plain-text statement updated every 60 days and published for independent verification, and stating that the measure does not prevent legal orders but helps ensure that any material change in the project's legal status cannot occur silently.
Joplin's cryptographically signed warrant canary, read on 2026-08-03 with a statement date of 19 June 2026 and a validity window to 18 August 2026, reports zero demands across five enumerated categories: no National Security Letters, no PATRIOT Act or FISA orders, no government request accompanied by a gag order, no requirement to introduce backdoors, and no compelled access to user data, servers or infrastructure.
The Joplin Privacy Policy publishes a table of every network connection the apps make with its default state: crash reports to Sentry are disabled by default and opt-in, while auto-update checks, the geo-location lookup, the spellchecker dictionary download from redirector.gvt1.com, and OCR language-file downloads from cdn.jsdelivr.net are enabled by default; the mobile wifi-connectivity check cannot be disabled.
Joplin publishes a technical specification of its encryption system describing the encrypted-data format and stating that master keys used to encrypt note data are themselves encrypted with the user's password before being transmitted with sync data.