Most notes apps could read your notes.
Not because anyone intends to. Because nothing stops them.
The text sits in a database a support engineer can query, and the only thing between it and a curious afternoon is policy.
I built Scratchpad so that policy isn't the only thing in the way.
Encrypted, Not Hidden
When you lock a note, its text is encrypted with a key derived from your password.
The database holds ciphertext. So does every backup, every snapshot, and every copy of the database on disk.
Now, I want to be exact about what that covers, because privacy writing has a habit of rounding up.
This is not end-to-end encryption.
Your password travels to the server over an encrypted connection. The server does the encrypting and decrypting. While the note is open, it holds the key in memory, never on disk.
What the lock protects is everything stored. A copy of the database, a backup, or a stolen disk is no help to anyone without the password.
The lock protects everything stored. Without the password, a copy of the database is no help to anyone.
That has one consequence worth hearing up front.
A forgotten password on a locked note can't be undone from our side, unless you've set up Face ID or Touch ID to open that note.
It is not a missing feature. It is the feature.
The Page Counter Gets Told Very Little
Scratchpad counts page views, using its own analytics running on its own server.
No third party is involved. It sets no cookies.
It's also told much less than an analytics script normally gets. Before anything leaves your browser, the address is rewritten:
| What the page knows | What the counter gets |
|---|---|
| The note's identifier | :id |
| A share link's token | :id |
| The query string | Nothing, it's dropped |
| The page title | A replacement |
So the count records that somebody opened a note.
It doesn't record which one.
Why The Title Matters Most
That last row matters more than it sounds.
It would have been easy to strip the identifier and call it done. On paper, that looks private.
But think about what actually travels with a page view:
- A share link is a working credential. It has no business sitting in anybody's log.
- A note title is often the most private thing on the page. It's the part that says what the note is about.
- Stripping one and sending the other is half a job. It's the kind of privacy that looks right in a diagram and fails in practice.
So both go. The counter learns that a note was opened, and that's the whole story it gets.
What This Costs
I'm not going to pretend this is free. Some things are harder this way.
- Search finds a locked note by its title, but not by the words inside it until you unlock it.
- Analytics can't tell us which notes are popular. (We don't care about that anyway.)
- Support can't look at your note to work out what went wrong.
Those are real costs.
They're also the point. If I could peek at a locked note whenever it was convenient, the lock would just be a nicer-looking policy, and we'd be right back where we started.
The honest version of privacy is the one that gets in my way too.
A promise that costs nothing to keep isn't much of a promise.
