Privacy Policy

Zero-Knowledge Data Protection

Your privacy is guaranteed by mathematics, not just promises.

At Lazy Notes, we implement strict zero-knowledge security protocols. All your sensitive information is encrypted locally on your device prior to cloud synchronization. We cannot read, see, or share your data under any circumstances.

1. Folder Name Encryption

Folder names are encrypted on the client-side using AES-256 symmetric key encryption before syncing.
The encryption key is generated locally using your Firebase unique identifier (UID).
In the cloud database (Firestore), folder names appear as randomized cryptographic ciphertext (e.g. U2FsdGVkX19...).
Folder structures are only readable by you and are decrypted in real-time when you open the app.

2. Note Title & Content Security

Note titles and contents are completely encrypted on your device using AES-256.
No plain-text credentials, passwords, usernames, or secrets ever hit the Firebase database.
Search indexes and previews are calculated locally on your decrypted data; they are never uploaded to the servers.
Your data remains secure even if database configurations are compromised or accessed by Firebase administrators.

3. Image & Media Encryption

Attached images undergo local client-side compression to minimize bandwidth and storage requirements.
Compressed image binary data is converted to base64 formatting and AES-256 encrypted using your master key.
The original image file name is also fully encrypted client-side using AES-256 before database saving.
The encrypted image package is stored directly in Firestore, preventing any unauthorized metadata extraction or image previewing.

4. Decryption Keys & Master Password

Your decryption keys are created client-side and reside strictly in your device's runtime memory or temporary session storage.
Raw decryption keys and custom master passwords are never transmitted to our servers or stored in any database.
If a global lock PIN is configured, the PIN is SHA-256 hashed locally, and only the cryptographic hash is saved to verify correct input.

5. Guest Mode & Local Storage

When using the app in Guest Mode, no data of any kind is synced to Firebase or the cloud.
All data, folders, notes, and compressed images are stored directly in your browser's local sandbox (`localStorage`).
Logging out of Guest Mode wipes all stored credentials, folders, and notes permanently from the browser sandbox.