← Back to blog
Security·6 min read

How Notetify Keeps Your Notes Private — The Technical Deep Dive

A plain-English explanation of how Notetify uses SQLCipher, AES-256-GCM encryption, on-device AI, and zero-cloud architecture to keep your notes completely private on Android.

When we say Notetify is private, we mean it at every level of the stack. Not as a feature. As a foundation.

Most note-taking apps treat privacy as a toggle you can enable. In Notetify, privacy is the architecture. Every design decision, from the database to the AI to the backup system, is built around one principle: your data never leaves your device.

Here's how that actually works.

The Database: SQLCipher + AES-256-GCM

Notetify uses SQLCipher — an encrypted version of SQLite — as its database engine. Every note, task, scanned document, and app setting is stored in an encrypted database on your phone.

The encryption uses AES-256-GCM (Advanced Encryption Standard with Galois/Counter Mode), which is the same standard used by governments and financial institutions for classified data. The "GCM" part means it provides both encryption and authentication — you can detect if someone has tampered with the data.

The encryption key is derived from your PIN or password using PBKDF2 with 100,000 iterations and HMAC-SHA256. This means even if someone has your encrypted database file, they can't brute-force your PIN — each attempt takes about 500 milliseconds, making millions of attempts computationally impractical.

App Lock: Biometrics + Hardware-Backed Keys

Notetify offers multiple lock methods:

  • PIN lock (6-8 digits)
  • Password lock (8-64 characters with strength indicator)
  • Biometric authentication (fingerprint or face)

When you enable biometric authentication, your master encryption key is stored in the Android Keystore — a hardware-backed secure enclave that exists on modern Android devices. The key never leaves this secure area. Your fingerprint unlocks the key, but Notetify never sees or stores your biometric data.

The app also includes:

  • Brute-force protection: Lockout timer after too many failed attempts
  • Timeout re-lock: The app automatically re-locks after 5 minutes in the background
  • Recovery code: A one-time code generated when you set your PIN, in case you forget it

On-Device AI: Whisper + ML Kit

Most apps that offer voice transcription or document scanning send your data to cloud servers for processing. Notetify does everything on your phone.

Voice Transcription

Notetify uses Whisper AI (by OpenAI) for speech-to-text conversion. The model runs entirely on your device using the whisper_ggml_plus library. After a one-time download of the model file (which happens over HTTPS with no personal data sent), transcription works completely offline.

Your audio never leaves your phone. No server processes it. No company stores it.

Document Scanning & OCR

Document scanning uses your phone's camera with auto-edge detection and auto-crop. Text recognition (OCR) is powered by Google ML Kit Text Recognition, which runs entirely on-device.

Each scanned page is individually encrypted using AES-256-GCM before being written to storage. Even the thumbnails are encrypted. When you delete a document, all associated files and database entries are permanently removed.

Smart Entity Extraction

Notetify uses Google ML Kit Entity Extraction to detect useful information in your notes:

  • Dates → Create tasks with one tap
  • Phone numbers → Call directly
  • Email addresses → Send an email
  • URLs → Open in browser
  • Physical addresses → Open in maps

This processing happens entirely on your device. No text is sent to any server for analysis.

Encrypted Backups

Notetify's backup system uses a custom .notetify binary format with dual-layer encryption:

  1. Your data is compressed into a ZIP archive
  2. The ZIP is encrypted with AES-256-GCM using a password-derived key
  3. Your document encryption key is separately encrypted and included in the backup
  4. Key derivation uses PBKDF2 with 100,000 iterations

The entire encryption process runs in Dart isolates (background threads), so your main app stays responsive. Backup and restore support cross-device transfer with automatic re-encryption — if you restore on a new phone, the data is decrypted with your old key and re-encrypted with your new device's key.

Zero-Cloud Architecture

The most important part of Notetify's privacy story is what it doesn't do:

  • ❌ No cloud storage
  • ❌ No account creation
  • ❌ No data collection
  • ❌ No analytics SDKs (no Firebase, no Google Analytics)
  • ❌ No tracking pixels
  • ❌ No telemetry
  • ❌ No server-side components
  • ❌ No push notification servers

When you delete Notetify, your data is gone — because it was never anywhere else.

Why This Matters

Every day, data breaches expose millions of users' personal information. Note-taking apps are especially sensitive — they contain your thoughts, your plans, your private documents, your voice recordings.

Notetify's approach means that even if our website were compromised, your notes would be safe. There's nothing to breach. There's no server to attack. Your data lives on your phone, encrypted with a key that only you control.

This isn't paranoia. It's engineering for the world we actually live in.