Passkeys and privacy

The full Privacy Policy and Terms of Service live on noted-this.date.

What stays private

Every workspace has its own key. Your notes, photos, tags and captions are encrypted with it before they are stored. The key itself is locked by your passkey, which never leaves your device or password manager.

A passkey signs you in with a private key that stays on your device, usually with ES256 (ECDSA P-256 and SHA-256); Settings → Account shows the algorithm of each one. To unlock, the passkey's PRF output goes through HKDF-SHA-256 to an AES-256-GCM key, which opens the workspace key.

We can see	We cannot see
Your account email and name	Entry text
Your plan, billing and storage used	Photos, captions and EXIF
How many entries you have and when they changed	Tag names and search terms

Sharing

Entries are private. On Pro you can make one public from the actions under it. Anyone with its link can read it. Photos are shown as thumbnails, without camera details, time or place. Making it private again removes the public copy, and links stop working if the workspace leaves Pro. A shared link shows a preview card with the opening lines and the first photo.

On Pro you can also turn on Settings → Workspace → Public page. It lists your public entries under your workspace name and icon at {nickname}.noted-this.date, with a photo wall and a calendar beside the timeline; photo places are never shown there. Once it is on, Share card sets the title, description and image people see when the page is shared, and Custom domain puts the page on your own address, such as journal.example.com: add the CNAME record it shows, and the page moves there once the certificate is ready. A domain can change once a month and is released if you turn the page off or leave Pro. The page also offers /rss.xml for feed readers, and /sitemap.xml and /llms.txt for search engines and AI tools.

These addresses only show your public page. You always sign in and write at noted-this.date. The name and icon can each change once a month.

Your own bucket Pro

On Pro you can keep your content in your own Cloudflare R2 or any S3-compatible bucket: Settings → Plan and data → Use my own bucket. Enter the endpoint, bucket name, region (auto for R2) and an access key that can read, write and delete. Vesper tests the bucket, then moves everything over while you watch; keep the page open until it finishes. Writing pauses during the move.

The bucket holds only ciphertext under vesper/, so whoever runs it cannot read your entries either. Shared thumbnails and your public page stay on Vesper. You can switch once a month, and Move back to Vesper brings everything back if it fits your plan's storage.

Losing access

We cannot read your content, so we cannot recover it either. There is no recovery code. If every passkey is lost, the content cannot be opened again.

To avoid that:

• Keep your passkey in a store that syncs between devices.
• Add a passkey on each device you use: Settings → Account → Add a passkey.
• Export your data from time to time while unlocked: Settings → Plan and data. Importing the archive there brings it back.

If you lost every passkey

On the unlock screen, choose Lost every passkey? and start over. The workspace and everything in it are deleted at once. You keep your account and start a new, empty workspace. A Pro subscription has to be cancelled first.