Privacy Centre
Everything xNotePadAI does to protect your data — explained in plain English.
🔐
AES-256-GCM
Military-grade encryption
🧂
PBKDF2 600K
Key derivation iterations
🔒
Zero-Knowledge
We can never read your notes
🍪
No Tracking Cookies
Zero tracking of any kind
📊
No Analytics
No Google Analytics, no telemetry
🤖
AI Requires Approval
Every AI change shown as diff
Encryption
Your notes are encrypted with AES-256-GCM — the same standard used by banks and governments. The encryption key is derived from your password using PBKDF2 with 600,000 iterations, making brute-force attacks computationally infeasible. Encryption and decryption happen entirely in your browser. The password never leaves your device.
Zero-Knowledge Architecture
When you enable sync, your notes are encrypted before leaving your browser. The server stores only encrypted blobs — it cannot decrypt or read your content. Even if our servers were compromised, your notes remain unreadable without your password. We cannot recover forgotten passwords because we never have access to them.
AI Never Silently Changes Your Notes
Every AI modification is presented as a diff. You see exactly what will change — additions in green, deletions in red. Nothing is applied until you click Approve. Agent mode operations that affect multiple notes show all proposed changes for review before any are executed. Full undo is available for 15 seconds after any bulk AI action.
Confidential Sections
Mark any section of a note as confidential and it is permanently excluded from AI processing. Confidential content is never sent to the AI model, never indexed in semantic search, and never returned by the MCP API. It remains encrypted locally.
Sync Integrity
Multi-device sync uses SHA-256 checksums to verify data integrity. If two devices edit simultaneously, you're shown the conflict and can choose: Keep Local, Keep Remote, or Save Both (which preserves both versions and tags the conflict for later review). No data is silently overwritten.
MCP API & Token Security
External AI agents connect via Bearer tokens. Tokens are stored as SHA-256 hashes — the plaintext is never persisted. Each token is scoped to one tenant and cannot access other users' data. Tokens can be revoked instantly from Settings. Rate limiting (30 req/min) prevents abuse. Confidential notes are never returned by any API call.
No Tracking
xNotePadAI has no tracking cookies, no Google Analytics, no telemetry, no fingerprinting, no user profiling. We don't know who you are, what you write, or how often you use the app. The only data that leaves your browser is encrypted sync blobs (opt-in) and AI queries (which exclude confidential sections).
Data Ownership
Your notes live in your browser's localStorage. You can export everything at any time (encrypted backup, plain ZIP, or individual files). You can delete all data with one click in Settings. There is no lock-in — your data is yours.
Auto-Lock
Configure auto-lock between 1 and 120 minutes. When triggered, notes are re-encrypted in memory and require your password to access again. You can also manually lock at any time.
In short:
Your notes are encrypted, your AI is controlled, your data stays yours, and we know nothing about you.