Standard Notes

Apps collect no usage data and no location data; notes are encrypted on-device before syncing so the server only ever holds ciphertext; analytics are self-hosted Plausible with anonymised IPs and no IP retention; the only identifiable data collected is your email address and optional user agent.

Data is disclosed only under legally compelled US authority requests; seven subprocessors are named with use cases and locations; cannot provide decrypted content regardless of legal compulsion; the main exposure is AWS for all primary hosting, US-based payment processors, and Zendesk for customer support.

Open source code, architectural E2EE, self-hosted Plausible analytics, and a commitment to minimal collection are genuine and verifiable privacy strengths — but US jurisdiction, AWS hosting, no published independent audit reports, and a notably thin policy for a service marketed on privacy principles hold the score back.