How your notes stay private

The short version

Sempere keeps your notes in a vault: a plain folder of encrypted files. Each of your devices makes its own key, which never leaves it, and a printed recovery kit holds one more. Every file is encrypted before it is saved, so whoever stores the vault (iCloud Drive, a NAS, a backup disk) holds ciphertext they cannot read. There is no server of ours.

The pieces

Device keys

Each device generates its own age key when it creates or joins a vault. It stays in that device's Keychain, available only on that device, never exported and never synced through iCloud Keychain; the device's signing keys are in the Secure Enclave where it has one. A vault opens by itself on a device that holds its key, or after Face ID or Touch ID if you ask for that. Keys are hybrid post-quantum, ML-KEM-768 with X25519: an attacker must break both, which covers copies of your files kept for later ("harvest now, decrypt later").

The recovery key

One more key per vault is printed in the recovery kit when the vault is created (as a QR code and as text, with the vault's root fingerprint and steps that need only stock tools), and kept by no device. It reads the vault, and it can take over managing devices when the device that manages them is lost. An optional copy can sit in the vault under a strong passphrase.

The vault key and the device list

Each file is encrypted once, to a vault key that vault.json holds wrapped for each device and for the recovery key. One device, the home, manages the list: a new device joins only after you type, on the home device, six words the new device shows, and the new device checks six words back. The list is authenticated under the vault key and signed by the home device (P-256 and ML-DSA-65), so someone with write access to your storage cannot add their own device: your devices refuse a list that does not check. Removing a device starts a new vault key at once, which the removed device never gets.

Encrypted notes

A note is a folder of write-once revision files, each an age file. Saves are appended, never overwritten, so sync tools never see a conflict and two devices can edit the same note and merge. Each file carries an authentication tag keyed from the vault key, so a file that someone planted or changed is rejected, not decrypted and trusted.

Encrypted attachments

Images, PDFs, video, recordings and transcripts are separate encrypted files, named with a keyed hash (no plaintext hashes on storage) and padded to a size class so exact sizes are not given away.

No server

Each device keeps a complete copy of the vault and works on it offline. Sync targets are shared .sempere folders (iCloud Drive or elsewhere) or WebDAV servers (over HTTPS; a self-signed certificate only after you trust its fingerprint; the password in the Keychain). Other devices open a target and join by approval. Every file that arrives is checked before it is placed. A WebDAV server you add is the only server the app connects to. A backup is a separate .sempere-backup snapshot for recovery: nothing syncs from it. There are no analytics and no servers of ours.

What anyone holding your files can see

Encryption keeps what you wrote, drew, recorded and attached private. It does not keep the existence of the vault private. Whoever stores the folder can see:

• file and folder names (random ids, device ids and counters, never titles), so how many notes there are and which device wrote each file;
• the size of each file (attachments are padded to a size class, revisions are not) and, for attachments, their kind (image, PDF, audio, and so on);
• when files were created and changed, which shows when you write and sync;
• what vault.json holds in the clear: the devices' public keys and names, which device manages the others, and the vault's display name if you set one, so these should hold nothing private; and requests of devices waiting to join.

Note titles, notebooks, tags and text are inside the encrypted files.

What is not protected

Limits, from DESIGN.md, the format specification and docs/security.md.

• An unlocked device. If someone can use your unlocked iPad or Mac, or malware runs there, they can read what you can read. Threats that need the unlocked device or your key file are out of scope.
• Lost keys. If every device and every copy of the recovery key are gone, nobody, including the developer, can decrypt your notes. Keep the paper kit and a backup.
• The recovery kit is a way in. Whoever has it and your files can read the vault and take it over. Every device alerts you after a takeover; replace the kit, or re-encrypt everything, if it may be in the wrong hands.
• A key copy in the vault is only as strong as its passphrase. If you keep a passphrase-protected copy of the recovery key in the vault, anyone with the files can try passphrases on it offline. Sempere refuses passphrases it estimates below about 70 bits; use six or more random words, or a long random password, used nowhere else.
• Removing a device does not unsee. A removed device keeps whatever it already decrypted, and files from before the removal still open with its key. Removal protects what is written afterward; Re-encrypt Everything also re-encrypts old files on the vault's targets, but not backups or a provider's version history. A removed device cannot take away your storage access either: change the password it used. Files it uploads after its removal are set aside, never read as notes.
• Plaintext on the device. Attachments opened for display, a recording until it is saved, a voice note until it is sealed and files staged for an export are kept unencrypted on the device, protected by the system's data protection where it has one. On a Mac the attachment cache is deleted when the app quits.
• Exports. A PDF, image, Markdown or media export is not encrypted.
• Quick voice notes. Recording from the Lock Screen is sealed without unlocking the vault, so anyone holding the locked device (after its first unlock) could add a voice note to your inbox. They cannot read your notes. A removed device cannot add voice notes.
• The web viewer is as trustworthy as the host that serves it. It decrypts in your browser and sends your key nowhere, but whoever controls the server can change the page. Serve it from a host you control, and use a browser profile without extensions for sensitive vaults. The demo here is a sample vault with a public key.
• On-device recognition and transcription use Apple's frameworks. Handwriting search and recording transcripts run on your device and are stored inside the encrypted note, but you are trusting Apple's code to do that work.
• Bugs. Software can have flaws. Please report any you find privately.

Check it yourself

• The on-disk format is public: docs/format.md. Notes are standard age files, so age -d, gunzip and jq recover a note without Sempere at all.
• The age implementation is checked against the public C2SP test vectors and the reference age tool. The live demo opens a real, encrypted vault in the web viewer.
• Why post-quantum, and the exact construction: docs/post-quantum.md.