Privacy Policy

Last updated: November 10, 2026

FUTO Notes is an offline-first notes app. Your notes are stored on your device, and the app never sends their contents to FUTO. If you turn on sync, your notes are end-to-end encrypted and sent only to a server you control. This page lists everything the app can send, and when.

Your notes stay on your device

Your notes are kept as files on your device. All core features work fully offline with no account. We do not have a server that holds your notes.

Sync is optional and self-hosted

FUTO Notes does not operate a cloud sync service. If you choose to enable sync, you point the app at a sync server that you host and control (the open-source FUTO Notes server). Your notes are end-to-end encrypted on your device before they are uploaded, so the server stores them only as encrypted data. FUTO does not receive, store, or have access to your notes or your sync password. Self-hosted sync does not send your email address to FUTO. If you separately sign up for sync availability notifications, we collect your email address as described below.

Your sync password also signs the app in to that server, so the server receives it each time a device signs in. Because you run the server, that is you. Put TLS in front of it if it is reachable from outside your network.

Concretely: each note, including its filename and folder path, is encrypted with AES-256-GCM under a random vault key generated on your device. That vault key is itself encrypted with a key derived from your sync password (PBKDF2-SHA-256, 100,000 iterations) before it is stored on the server, so a copy of the server's data cannot be read without the password. The server can see how many notes you have, how large each encrypted blob is, and when it changed. It cannot see what any note says or what it is called.

Sync availability notifications

If you choose to be notified when FUTO's hosted encrypted sync service is ready, we collect the email address you submit, with your consent. Signing up is optional and is not required to use FUTO Notes or self-hosted sync. We use the address only to send one or two emails about sync availability, not an ongoing newsletter or unrelated marketing.

You can withdraw your consent at any time by emailing [email protected] from the address you signed up with and asking to cancel sync notifications. We will remove your address from the notification list. Withdrawing consent does not affect the lawfulness of processing before withdrawal or your use of FUTO Notes. We delete the notification list after the final sync availability email.

Deleting your data

Crash reports

To help us find and fix bugs, the app saves a diagnostic report on your device when it crashes. Nothing is sent at that point. On the next launch the app asks whether to send it, and sends it only if you press Send. You can turn on Send crashes automatically to skip the question; it is off by default. Share crash reports, which controls whether the app asks at all, is on by default and can be turned off at any time in Settings → Issue reporting.

A crash report contains the error and stack trace, the app version, platform, and report type, the time of the crash, a random session identifier that changes each launch, and any note you choose to add before sending. It also describes your device: the model and OS version on iOS and Android, and on desktop the app's user-agent string and screen resolution. On desktop, a report also includes the screen you were on in the app. When a note was open, that includes the note's name and the folder it is in, though never its contents. Crash reports are sent to notes-crashlog.futo.org. They are not linked to your identity and are never used for advertising or tracking. Crash reports and feedback lists every field, per platform.

Feedback

Settings → Send feedback sends the message you type, any screenshots you attach, the app version and platform, your OS version, and your device model to notes-crashlog.futo.org. It is sent only when you press Send, whether or not crash reports are on. A PNG, JPEG, or WebP screenshot under 5 MB is sent as you picked it, including any metadata it carries, such as a photo's location. Feedback does not include the name or contents of any note.

Licenses

If you enter a license key on its own, the app sends that key once to FUTOpay at pay2.futo.org to activate it. Nothing else that identifies you is sent with it, and the request is never repeated in the background. If you open the activation link from your purchase, or paste the key together with its activation, the app checks the license on your device with no request at all. Buying a license from FUTO happens in your web browser, outside the app. On iPhone and iPad you can instead buy a license in the App Store; Apple handles that purchase, and it has no license key.

Update checks

On macOS, Windows, and the Linux AppImage, the app checks for a new version when it starts and once an hour after that, by downloading a small file from FUTO's GitLab at gitlab.futo.org. The request includes nothing about you or your device, though like any request it reveals your IP address. Turn it off in Settings → Updates. The iPhone, iPad, and Android apps do not check for updates themselves; the store you installed from does.

Images from the web

A note can include an image by its web address. When you open such a note, the app loads the image from the site that hosts it, which sees your IP address and which image was requested. Images you add from your device are copied into your notes folder and never loaded from the web. Network requests lists every request the app can make.

What we don't do

We do not use analytics, advertising, or third-party tracking. We do not sell or share your data. The app requests only the permissions it needs for features you use: for example, camera or photo access on iOS when you attach an image to a note, or "All files access" on Android if you keep your notes in device storage.

Contact

For privacy questions or data-deletion requests, contact us at [email protected].