Why I Built Private Notes With Encryption

Notes are some of the most personal text we write. Lists, plans, drafts, half-formed ideas. I wanted a notes app where the question "who can read this?" has a clear, short answer.

That is the reason Sidekick Note exists. It is a Markdown note app I designed and built.

Plain text you can take with you

I wanted notes in a format that outlasts any app. Markdown does that. A note is a text file in a portable format, so I am not locked in. You can read more about the product on the Sidekick Note case study.

What I built

Sidekick Note is a web app with a Chrome side panel. Notes are Markdown, and a fenced block can become a card such as a recipe, a checklist or a chart. You can bring notes in from 15 sources. The demo page shows it with sample notes.

Protection has two levels. I describe them the way the product's own help page does. Both start from the same idea: every note and image is encrypted on your device and stays encrypted in the cloud.

Standard protection. This is the default for everyday notes. Your notes are sealed with a random key made for your account. That key is itself locked by a key in a cloud key management service and opened only for your signed-in account. Staff cannot browse your notes, and notes are never used for ads or AI training. There is no passphrase to remember. If you lose a device, you sign in on another one.
Private notebooks. When you want more, you can make a single notebook private. It gets its own key, locked by a passphrase only you know. You also get a recovery code, shown once, to print, download or keep in a password manager. Nobody else can open that notebook, not even me.

Lock and unlock

A private notebook is locked when the app starts. Its notes are hidden from lists and search until you unlock it with the passphrase or the recovery code. It also locks again after a period of no use. The default is 30 minutes, and you can set it to 5, 15, 30 or 60 minutes, or turn it off, per device.

Moving a note into or out of a private notebook asks first, because the note is sealed again with the other key. AI chats and images added to a private note are sealed with the notebook key too.

Try the difference

The toy below uses a sample note. Switch the notebook between Standard and private and watch what the server would hold and who can open it. The scrambled text is a pattern for teaching. It is not real encryption, and nothing leaves your browser.

Interactive · toy

Two protection levels in Sidekick Note, as its help page describes them.

Standard: notes are encrypted on your device and in the cloud. The account key is locked by a cloud key service and opened for your signed-in account. No passphrase. Staff cannot browse your notes.
Private notebook: its own key, locked by a passphrase only you know, plus a recovery code.
Lose the passphrase and the recovery code and nobody can open that notebook.
A public share link is readable by anyone who has it. A private link is end-to-end encrypted.

What encryption does not do

End-to-end encryption protects the content of a note. It does not fix everything.

A share link is a different thing. A public publish link can be read by anyone who has it. The app warns you when you share a note from a private notebook.
AI features send text to an AI service when you ask. For a private note, the app asks first, once per note per session. On-device AI does not ask.
A lost passphrase is a real loss. If you lose both the passphrase and the recovery code, nobody can open that notebook. That is what "end-to-end" means.

I make no claim that this is the best design for everyone. I describe what it does, and I keep the key design out of public pages.

Where to go from here

If you are building a notes app, a tool with private content, or anything where users ask "who can read this?", I would be glad to talk it through. You can also see how I think about AI features and the sign-in work behind Sidekick Note.

Book the free consult