Security

Where a notebook lives

A notebook is a SQLite database, and it lives on your device:

• On a Mac, it is one file in a folder on your Mac. Your first notebook is in the Fennick Notebooks folder in your home folder, and a new one goes in a folder you choose. Any program can open it, and you can copy, move or back it up like any other file.
• On an iPhone, it is kept in the Fennick app’s own storage on the phone.
• In a browser at fennick.app, it is kept in that browser’s own storage on your computer.

A notebook you don’t sync never leaves your device. Fennick does not send it to us.

The copy on your device

Fennick does not encrypt the notebook on your device. That is on purpose: it keeps your notes readable by any program, so you can always get them out. To protect a lost or stolen device, use your device’s own encryption: turn on FileVault on a Mac, and set a passcode on your iPhone.

When you sync a notebook

Sync is your choice, and it needs an account. A synced notebook is copied to our sync server, which runs on Fly.io in the United States (Virginia), so your other devices and the web app stay up to date.

On the way. Every connection to the sync server uses HTTPS. Pictures and files go straight between your device and their storage at Cloudflare over HTTPS, through links that are signed and last only a few minutes. No file has a public link.

Where it is kept. The server’s disk is encrypted by Fly.io. Pictures and files are kept by Cloudflare, which encrypts every stored file (AES-256).

Not end-to-end encrypted, yet. The keys for that encryption are held by the services, not by you. So our server can read a synced notebook, and so can the people who run it. End-to-end encryption, where only your devices hold the key, is coming as a per-notebook choice after the alpha. Until then our server can read synced notebooks.

People on the Fennick team look at a synced notebook only when you ask us to (for example, to help with a problem you report), when we must to keep the service safe and working, or when the law requires it.

Backups

Every change to a synced notebook is copied to backup storage at Backblaze within moments, and a full copy of the notebook is made every day.

Each backup is compressed and then encrypted before it leaves our server, with a public key only. The server can write backups but cannot read them, and neither could someone who broke into it. The private key that opens them is never on the server.

Backups are locked when they are written (Backblaze’s Object Lock): they are kept for a fixed period and cannot be changed or deleted until it ends.

The restore drill

A backup is only good if it restores. Every day, an automatic check on a separate machine (a GitHub Actions run, never our sync server) restores the newest backups, checks each one is whole, and compares it with the live copy on our server. If anything does not match, the check fails.

To check a backup the drill has to open it, so it holds its own key. It reads the backup on that machine and writes nothing anywhere. Nobody reads your notes as part of it.

Who can see a notebook

• You. A synced notebook syncs only to your own devices, signed in to your account. Each device gets its own sync key. Sharing a notebook with other people is not here yet; this page will say how it works before it is.
• Programs on your Mac. The notebook file is readable by programs you run there, including agents. That is by design: your file is yours.
• Agents. Today an agent reaches a notebook only through programs on your own computer. It can read a notebook file there, or use the Fennick connector, which runs on your Mac as one of that notebook’s synced devices. The connector holds that device’s own sync key, kept in the Mac’s Keychain; the agent never sees it. The connector can reach the whole notebook. Its changes sync through our server like any device’s, and each one is in the Op Log under the agent’s name. Agents in the cloud are coming. Until then, an agent reaches a notebook only through the Fennick app on the same Mac. You make the connector’s key for your notebook when you set it up; the setup steps are in Help, under Connect your agent.
• The Fennick team can read synced notebooks, because they are not end-to-end encrypted (see above).
• The companies that run our services hold what their part needs: Fly.io runs the sync server; Cloudflare keeps pictures and files; Backblaze keeps the backups, which it cannot read; GitHub runs the restore drill; Supabase handles sign-in. Our Privacy page lists them all.

Signing in

Sign-in is handled by Supabase: an emailed link or code, or a passkey. Our sync server checks each sign-in itself against Supabase’s public keys, and keeps only your account’s id. It never reads your email.

Each device you sign in on gets its own sync key. The server keeps only a fingerprint of each key (a hash), never the key itself, and checks it on every request. Signing out ends that device’s key at once.

Fennick isn’t open yet: the server takes only accounts that have been invited.

App updates

The Mac app looks for a new version of itself when it opens and once an hour after that, by reading a public list of versions on GitHub. Each new version is signed with our key, and the app checks that signature before installing it. The app is signed with an Apple Developer ID and checked by Apple (notarized). It always asks you before it restarts to update.

The Mac and iPhone apps also load their screens from fennick.app over HTTPS, and keep a copy of the main page so they open at once. Each time one opens, it asks fennick.app for a newer page, and keeps it only if it matches the list of files and their fingerprints (hashes) published with it.

None of these checks sends your notes, your name or your email.

If you find a problem

If you think you have found a security problem in Fennick, please tell us privately first, at security@getfennick.com.

Changes to this page

If how Fennick keeps your notes changes, we’ll update this page and the date at the top.

See also: Privacy