FlosForge Notes — privacy policy

FlosForge Notes has no servers and no accounts, and it sends nothing about you or your notes to anyone. Your notes are files on your own devices. The app connects to the network only for sync you set up yourself, encrypted before it leaves, and to load a picture you linked from the web.

What FlosForge Notes collects about you

Nothing. There is no account, no telemetry, no analytics, no crash reporting and no identifier of any kind. The app has no server of its own to send anything to, and it does not phone home to check for updates — you install new versions yourself.

What it stores, and where

Your notes, as files: Markdown and handwriting files in the folders you chose, with attachments beside them, and a small metadata folder holding comments, workspace settings and templates.
Encrypted, if you choose: With workspace, folder or note encryption on, the content of each file is encrypted with a key derived from your password. File and folder names stay readable.
On each device only: Search indexes and version history are kept per device and never synced.
Sync credentials, in the system’s own vault: Storage keys and the sync key are kept in the Keychain, Windows DPAPI or the Linux keyring on desktop, and the Android Keystore on the phone — never in the workspace folder. On Linux without a keyring, the app refuses to store them rather than keep them in plain text.
Left out of phone backups: The Android app opts out of Google’s cloud backup.

Everything it can connect to

There is no FlosForge server. These are the only connections the app ever makes, and each one is something you set up or put in a note.

Your other devices, over your own network: With local-network sync on, devices find each other on your Wi-Fi and exchange changes directly. Every exchange is encrypted with your sync key; only while you are adding a device, for ten minutes, are the device and workspace names sent unencrypted on your local network.
Storage you own: Cloudflare R2, an S3-compatible service, or Google Drive on desktop — only if you connect it. What is stored there is encrypted on your device first, under random names, so the provider cannot read titles, folders or content. Google Drive access is limited to the app’s own hidden folder.
Pictures you linked from the web: An image in a note that points to a web address is loaded from that address, like in any browser.
Links you open: A web link in a note opens in your own browser.

What never leaves your devices

Nothing about you or your notes is sent to FlosForge — there is nowhere to send it.
No telemetry, no analytics, no crash reporting, no ads and no account.
No AI features, and no note is ever processed anywhere but on your devices.

Safeguards

End-to-end encrypted sync, by default: A random sync key protected by your sync password or a recovery key, XChaCha20-Poly1305 for every object, and names derived with a keyed hash so the provider cannot even test for known content.
Nobody can recover it for you: Not the storage provider, and not FlosForge. If both the sync password and the recovery key are lost, the synced data cannot be decrypted by anyone.
A locked-down desktop app: The window runs sandboxed with context isolation and no Node access, navigation away from the app is blocked, and the only device permission it ever grants is the microphone, for voice notes.
App lock: A passcode on desktop that locks with the screen, and a PIN with fingerprint or face unlock on Android, which also hides the app’s preview in the recent-apps screen.

Your rights, and who to ask

Because the app holds nothing about you, there is nothing for the controller to access, correct or erase on your behalf: everything it knows is in files on your own devices, under your own control. Your notes are ordinary files in the folders you chose, so they stay until you delete them. Uninstalling removes the app’s own data — settings, search caches, local version history and, on Android, its sync store. Anything you synced to your own storage stays there until you delete it from your provider. For anything else, write to hello@flosforge.eu. The site-wide privacy policy covers this website, your rights under the GDPR, and the supervisory authority you can complain to.

Changes

This statement is checked against each release. If a version changes what the app stores or what it can connect to, the version and date at the top change with it.