Privacy Policy

Last updated: September 24, 2026

FUTO Notes is an offline-first notes app. Your notes are stored on your device, and the app never sends their contents to FUTO. If you turn on sync, your notes are end-to-end encrypted and sent only to a server you control. This page lists everything the app can send, and when.

Your notes stay on your device

Your notes are kept as files on your device. All core features work fully offline with no account. We do not have a server that holds your notes.

Sync is optional and self-hosted

FUTO Notes does not operate a cloud sync service. If you choose to enable sync, you point the app at a sync server that you host and control (the open-source FUTO Notes server). Your notes are end-to-end encrypted on your device before they are uploaded, so the server stores them only as encrypted data. FUTO does not receive, store, or have access to your notes, your email address, or your password.

Your sync password also signs the app in to that server, so the server receives it each time a device signs in. Because you run the server, that is you. Put TLS in front of it if it is reachable from outside your network.

Concretely: each note, including its filename and folder path, is encrypted with AES-256-GCM under a random vault key generated on your device. That vault key is itself encrypted with a key derived from your sync password (PBKDF2-SHA-256, 100,000 iterations) before it is stored on the server, so a copy of the server's data cannot be read without the password. The server can see how many notes you have, how large each encrypted blob is, and when it changed. It cannot see what any note says or what it is called.

Deleting your data

• On your device: open Settings and use Full reset to delete everything in your notes folder, including any other files stored there, and disconnect sync.
• Synced data: because sync data lives on a server you host, you delete it directly on that server. FUTO operates no account service and holds no copy of it.

Crash reports

To help us find and fix bugs, the app saves a diagnostic report on your device when it crashes. Nothing is sent at that point. On the next launch the app asks whether to send it, and sends it only if you press Send. You can turn on Send crashes automatically to skip the question; it is off by default. Share crash reports, which controls whether the app asks at all, is on by default and can be turned off at any time in Settings → Issue reporting.

A crash report contains the error and stack trace, the app version, platform, and report type, the time of the crash, a random session identifier that changes each launch, and any note you choose to add before sending. It also describes your device: the model and OS version on iOS and Android, and on desktop the app's user-agent string and screen resolution. On desktop, a report also includes the screen you were on in the app. When a note was open, that includes the note's name and the folder it is in, though never its contents. Crash reports are sent to notes-crashlog.futo.org. They are not linked to your identity and are never used for advertising or tracking. Crash reports and feedback lists every field, per platform.

Feedback

Settings → Send feedback sends the message you type, any screenshots you attach, the app version and platform, your OS version, and your device model to notes-crashlog.futo.org. It is sent only when you press Send, whether or not crash reports are on. A PNG, JPEG, or WebP screenshot under 5 MB is sent as you picked it, including any metadata it carries, such as a photo's location. Feedback does not include the name or contents of any note.

Update checks

On macOS, Windows, and the Linux AppImage, the app checks for a new version when it starts and once an hour after that, by downloading a small file from FUTO's GitLab at gitlab.futo.org. The request includes nothing about you or your device, though like any request it reveals your IP address. Turn it off in Settings → Updates. The iPhone, iPad, and Android apps do not check for updates themselves; the store you installed from does.

Images from the web

A note can include an image by its web address. When you open such a note, the app loads the image from the site that hosts it, which sees your IP address and which image was requested. Images you add from your device are copied into your notes folder and never loaded from the web. Network requests lists every request the app can make.

What we don't do

We do not use analytics, advertising, or third-party tracking. We do not sell or share your data. The app requests only the permissions it needs for features you use: for example, camera or photo access on iOS when you attach an image to a note, or "All files access" on Android if you keep your notes in device storage.

Contact

For privacy questions or data-deletion requests, contact us at [email protected].