What Lyunotes doesn't do

The limits

What to know

• If you lose both your password and your recovery key, that Lyunotes notebook can't be opened. We can't get you back in, because we can't open it either.
• Encryption is per notebook, and it's your choice. Turn it off and the notebook is stored as plain text. See Check 1.
• If your device is compromised, or you hand it over unlocked, we can't protect what's open.
• Some things stay visible in your cloud even for encrypted notebooks. See what you can still see.
• Your cloud provider keeps whatever its own service records. That's up to them.
• Sync goes through your cloud, so conflicts can still happen. Lyunotes has safeguards that reduce the risk to your notes, but because we don't control your cloud's servers, we can't prevent every case. Two devices changing the same notebook at the same moment can conflict. Let sync finish before you switch devices.
• The app talks to a few servers beyond your cloud. See Check 2.
• No independent audit yet. That's why you can check things yourself.

Something here doesn't match what you see? security@lyunotes.com

Your password and recovery key

What to know

Your password and your recovery key are the only two ways into an encrypted notebook. We hold neither.

The recovery key is shown once. When you turn on encryption, the app shows you a recovery key a single time. Write it down, put it in a password manager, keep it somewhere you'd keep a spare house key. Don't share it.

Lose both, and the notebook is gone. If you forget your password and lose your recovery key, nobody can open the notebook, including us.

Changing a key doesn't undo what's already out there. Changing your password or recovery key replaces the key wrapping in your notebook's settings, but it does not re-encrypt your notes: the master key stays the same. Older copies of that wrapping, such as the app's own backup of the settings, copies kept inside some other notebook files until the app next rewrites them (editing a note's text doesn't do that), and your cloud's version history or your backups, may remain openable with the old password or old recovery key, and that is enough to reach the master key. If an old password or recovery key may have been exposed, use Rebuild Encryption. It creates a new notebook under a brand-new master key. Once you've confirmed the new notebook, delete the original and empty its trash, and delete old versions in your cloud storage if it keeps history. We can't remove old copies from your cloud storage for you.

How your password protects the key, and what that means for guessing: How your password protects the key.