Notesnook is a free, open-source (GPLv3 clients, AGPLv3 sync server), end-to-end encrypted note-taking app developed by Streetwriters (Private) Limited, a small self-funded company based in Khushab, Pakistan, whose terms are governed by Pakistani law. Its privacy policy and help docs state that notes, notebooks, tags and attachments are encrypted on the device with XChaCha20-Poly1305 and Argon2 before sync, so the server (hosted on Hetzner in Germany, with attachments on iDrive e2 behind Cloudflare CDN) holds only ciphertext plus the account email and subscription state; Paddle processes payments and GitHub is used for CI. No breach or regulatory action was found, but no third-party security audit has been completed (the roadmap lists one as Planned) and the repository has no published security policy.
TIMELINE
NO ENTRIES ON FILE YET.
TOOLS WE RECOMMEND
PLUS
RECEIPTS
19 ON FILE
COLLECTION
Notesnook's help documentation states that account deletion is self-serve from the app's Settings, without questions or waiting on email, and that deletion permanently removes all notes, notebooks, attachments, the login credentials (email and password), subscription and billing information, and the account itself.
Notesnook's help documentation describes the end-to-end encryption design in detail: notes are encrypted per-item on the device with XChaCha20-Poly1305-IETF using a data key protected by an Argon2-derived master key, the password itself never leaves the device (only an Argon2 hash is sent), and the server stores only ciphertext it cannot open — which also means the operator cannot recover notes for a user who loses both password and recovery key. The page states it is an explanation, not a formal specification.
In a July 2022 blog post the lead developer explains why Notesnook requires an email address for an account (bot/spam prevention, account recovery, and reaching users after an incident), acknowledges email as an identifier and spam risk, recommends aliases, and states that as of that date a database compromise would expose only users' email addresses; the post also outlines a plan to store only a hashed email by default in future.
Notesnook's privacy policy (effective June 19, 2023) states that the only personal data it may ask for is an email address, and that it may also collect usage data (IP address, browser/device type, pages visited, unique device identifiers and other diagnostics) — but that the user can opt out of all such usage-data collection at any time by disabling Telemetry in the app's Settings. The policy also states that all user-created data is encrypted on the device with XChaCha20-Poly1305 and Argon2 before transmission and stored on servers in Germany.
The iOS App Store listing shows the seller as Streetwriters Private Limited while the developer name on the privacy-label section reads 'Streetwriters LLC' — the same company under two legal-form suffixes; no company-registry filing (e.g. Pakistan's SECP) was fetched in this research to confirm the registered form.
Notesnook's About page names the operating company as Streetwriters (Private) Limited, based in Pakistan, with a street address in Khushab (Punjab) and a D-U-N-S number (645813663); it names the four-person team (Abdullah Atta, CEO and lead developer; Ammar Ahmed; Muhammad Ali; Zulfiqar Ali) and states the company is independent, self-funded solely from subscription fees since April 2021, and has no VC funding or intention to raise.
F-Droid's listing for Notesnook (version 3.4.9, built and signed by F-Droid from source) lists the author as Streetwriters (Private) Limited, the license as GNU General Public License v3.0 only, and links the source repository; the listing carries no anti-feature flags.
The Notesnook client monorepo (web, desktop, mobile, web clipper, crypto and core packages) is published on GitHub under the GNU General Public License version 3.
Notesnook's Terms of Service (effective June 19, 2023) name Streetwriters (Private) Ltd. as the operator and state the terms are governed by the laws of the Islamic Republic of Pakistan (the source text runs 'ofIslamic' together) — meaning users' contractual and data-protection remedies sit under Pakistani law even though data is hosted in Germany.
Notesnook's About page discloses its hosting chain and history: user data was stored in Singapore on Upcloud from April 2021 to August 2022, has been on Hetzner servers in Germany since August 2022, attachments moved from Wasabi S3 to iDrive e2 (still in Germany) in August 2024, and Cloudflare CDN is used to serve attachments — with a statement that user data has never been stored unencrypted.
The Notesnook Sync Server — the backend that stores and relays users' encrypted data — is published in full as open source under the AGPLv3, allowing anyone to inspect what the server can and cannot do with the data it receives, or self-host it.
Notesnook's sync documentation states that note content, titles, notebooks, tags, colors, reminders and attachments are all encrypted on-device with a password-derived key before leaving it, so the sync server holds only ciphertext it relays between a user's devices; sync is free on every plan and the app works fully offline (local-first).
Notesnook's privacy policy states it does not sell or rent personal information to any third parties for any purpose, that all user-created content is encrypted on-device before transfer to its servers in Germany, and it names its third-party processors: Paddle for payments (card details never stored by Notesnook) and GitHub for CI/CD. The policy also reserves the right to transfer personal data in a merger, acquisition or asset sale.
Notesnook's public roadmap lists a 'Third-party security audit' with status Planned — i.e., as of this research the operator itself states no independent audit has been completed.
The GitHub security-policy page for the streetwriters/notesnook repository reports that the project has not set up a SECURITY.md file, so there is no published vulnerability-disclosure policy or scope; no breach or regulatory action involving Notesnook was found in this research.
Notesnook is listed by Privacy Guides under its Notebooks (cloud-based) recommendations, whose minimum criteria require open-source clients, end-to-end encryption for any cloud sync, and export to a standard format.
The iOS App Store privacy label for Notesnook (seller Streetwriters Private Limited) declares only 'Data Not Linked to You' — Usage Data and Diagnostics (crash, performance and other diagnostic data) used for app functionality — and no data linked to identity or used for tracking.
In a February 2023 blog post the lead developer states Notesnook switched its in-app telemetry from opt-out to opt-in, publishes the list of events it sends (app version on startup, checkout/purchase-dialog events, announcement interactions, account created), and explains that the data goes to a self-hosted Umami instance via an in-house script that sends screen size, language, hostname and URL rather than Umami's own tracker script.
Notesnook's privacy policy states it uses self-hosted service providers for analytics, naming Umami (a self-hosted web traffic analysis tool) as the only analytics provider, and states that it honors Do Not Track browser signals by not tracking, planting cookies or using advertising when DNT is set.