2026-05-22 · · Daniel A

Can Anyone Else Read My Notes? The Honest Answer

In most apps, yes · employees or hackers can technically read your notes. However, in a zero-knowledge app like SimplyBoard, your data is encrypted on your device using AES-256-GCM before it is ever synced. This means no one, not even the developers, can read your content without your password.

The honest answer is that in most popular apps, yes, the company or a sophisticated attacker can read your notes. In a zero-knowledge, client-side encrypted app like SimplyBoard, the answer is a definitive no. Unless someone physically holds your unlocked device or knows your master password, your data is mathematically unreadable to everyone, including the developers.

It is the question that quietly sits in the back of every privacy-aware person's mind when they open a notes app. If someone really wanted to · a rogue employee, a government agency, or a hacker who breached the database · could they read this?

The answer depends entirely on one technical detail most apps avoid talking about: who holds the encryption key.

Private is not the same as encrypted

Companies love the word "private." It sounds reassuring. It also means almost nothing in a technical sense. When a service provider says your data is private, they are usually describing a policy, not a technical reality.

"Private" usually means the company promises not to look at your data and promises not to sell it. This is a legal agreement. However, policies can change. Employees can break them (as seen in numerous "God Mode" scandals at major tech firms). Governments can override them with subpoenas. Attackers can ignore them entirely once they gain access to the server.

"Encrypted" means something stronger, but even then, you must ask *where* it is encrypted. If the company encrypts your data on their servers, they still hold the keys. They are essentially locking your front door but keeping a master key in their office.

True security requires client-side encryption. This means the data is mathematically scrambled on your device, and only someone with your specific key can unscramble it. If the company does not have the key, the company physically cannot read your notes, no matter who asks.

Who can read notes in a typical "private" app

If you use a standard cloud-based notes app that does not specify "zero-knowledge" or "end-to-end" encryption, the following groups can technically access your content:

• Engineers with production database access: While usually restricted, senior developers often have the tools to view raw database rows for troubleshooting.
• Support staff using admin tools: Many "private" apps allow support agents to "impersonate" or view user accounts to help solve tickets.
• Hackers who breach the server: If the database is stolen, and the company holds the keys, the hacker can eventually decrypt the entire dataset.
• Governments and Law Enforcement: If served with a valid legal request, companies that hold the keys are legally required to hand over your decrypted data.
• Machine Learning Systems: Many modern productivity apps scan user content to train AI models or provide "smart" suggestions.

Where popular apps actually sit

Most household names in the productivity space prioritize convenience over absolute privacy. Apps like Apple Notes, Google Keep, Notion, Evernote, and OneNote store your notes in a form their servers can read.

While some of these offer optional "locked" notes or "vaults" with extra encryption, the default state for the vast majority of your data is plaintext on their infrastructure. This is not necessarily a "scandal" · it is a deliberate tradeoff. By holding the keys, these companies can offer features like:

• Server-side search (searching through gigabytes of notes instantly).
• AI-powered summaries and content generation.
• Rich web previews for links.
• Easy password recovery if you forget your login.

The cost of this convenience is that your data lives on their servers in a readable form. For many users, this is acceptable. For those storing sensitive intellectual property, journals, or command snippets, it is often a dealbreaker.

A smaller group of apps, including SimplyBoard, Standard Notes, and Proton, use what is called zero-knowledge encryption. In these systems, the server only ever sees "ciphertext" · a random string of characters that is useless without your password.

What zero knowledge actually means

Zero knowledge is a precise technical claim, not marketing fluff. It means the operator of the service has no technical ability to read your data, even if they are forced to by a court order.

In a robust zero-knowledge system like SimplyBoard, the process looks like this:

1. Key Derivation: Your password is never sent to the server. Instead, it is put through a memory-hard function called Argon2id on your device. This turns your password into a high-entropy encryption key.
2. Encryption: Your notes are encrypted using AES-256-GCM (the industry gold standard) directly in your browser or app.
3. Transmission: Only the encrypted "blob" is sent to the server.
4. Storage: The server stores the blob. It has no idea if that blob contains a grocery list or a secret business plan.

If a court served the company tomorrow, they could only hand over scrambled bytes. If a contractor went rogue, they would see nothing but gibberish. This is why there is no server-side password reset for your content; if we could reset your password, it would mean we have the power to access your data.

Three questions to ask any notes app

If you want a straight answer about whether a notes app can read your data, these three questions cut through the marketing:

1. If I forget my password, can you reset it and give me back my notes? If the answer is "yes," they hold a key that can decrypt your notes. That key is a single point of failure.
2. Where does encryption happen? If it happens on their servers (at rest), they are protected from outside hackers, but you are not protected from the company itself. It must happen on your device.
3. Can you search my notes from a new device before they are downloaded? If a server can search your notes without you being logged in on that specific device, the server can read your notes.

The SimplyBoard approach to privacy

At SimplyBoard, we built the app for people who ship · developers, founders, and creators who need a fast, private alternative to the status quo. Our architecture is offline-first and privacy-first by default.

• We cannot read your notes: Not your titles, not your tags, not your content.
• Client-Side Encryption: Everything is encrypted on your device before it touches our SOC 2 and ISO 27001-certified infrastructure.
• No Password Resets: We provide a one-time recovery code during setup. This is the *only* way to recover your data if you forget your password, because we don't have a "backdoor."
• Search-First, Not Spy-First: We offer instant fuzzy search, but it happens entirely on your local device using an encrypted IndexedDB cache.

The tradeoff for this level of security is responsibility. You own your keys. But in exchange, you get the peace of mind that the answer to "can anyone else read my notes" is a simple, honest no.

· The SimplyBoard Team