Notes Tech v2.0.4
Your notes stay in your pocket. Encrypted, and offline.
Security audit — August 2026Why Notes Tech
A note-taking app that shares nothing with anyone — because it is technically unable to.
Zero internet
No INTERNET permission in the manifest. The app is technically unable to send any data. Verifiable.
Encrypted database
SQLCipher AES-256 with the key sealed by the Android Keystore (hardware-backed). Uninstall = lose everything, irrecoverable.
Per-folder vaults
Each folder can be a vault: Argon2id passphrase (m=64MB) or Keystore-sealed PIN + self-destruct after 5 failed attempts.
Panic mode
Discreet gesture → KEK destroyed, database overwritten, dictation model wiped, Keystore keys cleared. Everything goes in seconds, even if the phone is seized unlocked.
Voice dictation
On-device Whisper (~57 MB) — flawless local transcription, audio never persisted, SHA-256 model verification.
27 MB, not 290
The app fits in a 27 MB APK (arm64). No language model bundled: what you install is an encrypted note editor, not a data centre.
Backlinks [[Title]]
Outbound links + "Mentions" panel (backlinks) + auto-completion. Ghost links auto-resolved on creation.
Instant FTS5
SQLite full-text search with Unicode tokenizer, normalized diacritics. Response in milliseconds.
Screenshots blocked
Optional FLAG_SECURE — hides the preview in the Android app switcher, blocks screenshots.
Plain Markdown
No proprietary format. Your notes are text files you will always be able to read, anywhere, in 20 years.
Bilingual FR / EN
Full interface in French and English (since v1.0.0). Language selector in Settings, follows the system locale by default. Legal pages localized.
Apache 2.0
Source code entirely public on GitHub. Verify the privacy promises yourself.
Free, of course ;)
No subscription, no freemium, no quota, no premium version. Never will be.
Screenshots
How it works
An encrypted database, a full-text index, a voice transcription engine. Nothing else — and nothing that leaves the phone.
1. You write
Classic Markdown notes, debounced auto-save, configurable sorting, pin / favorites / trash. Your notes go straight into an encrypted SQLite database (SQLCipher AES-256) whose master key is sealed by the Android Keystore — an attacker who dumps /data/data recovers nothing exploitable without the phone unlocked.
2. The app indexes in the background
Each note feeds an FTS5 index maintained by SQLite triggers, with a Unicode tokenizer and normalized diacritics — "reiki" finds "Reiki" as well as "réiki". Search answers in milliseconds, even across thousands of notes. The content of a locked vault never enters that index: the triggers mask the column for as long as the note stays encrypted.
3. You dictate
Mic button in the editor. Whisper (C++ port by Georgi Gerganov, base model q5_1 ~57 MB, imported from HuggingFace) transcribes what you say, the text is inserted at the cursor. The captured WAV stays in the app's private tmp area and is deleted immediately after transcription, on every exit path (success, cancel, error, system kill).
4. You stay in control
Panic mode which destroys the Keystore key and makes the database unreadable forever. "Hide from recent apps" setting which blocks screenshots and hides the preview. Everything is under Apache 2.0 — you can compile it yourself from source.
Privacy commitments
No empty promises. Only commitments verifiable in the code.
| Commitment | Notes Tech | Verifiable |
|---|---|---|
| Internet permission | Removed from manifest (tools:node="remove") | aapt dump permissions |
| Tracker / ad SDK | None | GitHub source code inspection |
| Third-party crash reporter | None | No Crashlytics, Sentry, etc. dependency |
| Account / sign-up | None | No login screen |
| Note storage | Local + encrypted | SQLCipher in /data/data/com.filestech.notes_tech |
| Dictation model | Imported by you, SHA-256 verified | Official HuggingFace source |
| Recorded audio | Deleted after transcription | Covered by try/finally in the code |
| Source code | Full Apache 2.0 | github.com/gitubpatrice/notes_tech |
Who it's for
- Wellness practitioners, therapists, energy practitioners who take notes on client sessions — professional secrecy is not optional
- Journalists, lawyers, doctors handling sensitive sources or files
- Anyone who refuses to let their private notes end up in a cloud or a training model
- Travelers and nomads who want an app that works in airplane mode, abroad, without data
- Curious tinkerers who want to understand how notes get encrypted at rest, how an Argon2id vault key is derived and how an FTS5 index is maintained — and read the code
Honestly, the limits
- No AI. The question-answering and semantic search features have been removed: they forced a 290 MB APK and a 530 MB model to import, for uneven results. Search is now full-text — fast and exact, but it will not guess synonyms.
- Voice dictation adds ~57 MB of model if you enable it. Optional, and Whisper Base is not infallible on proper nouns.
- No rich Markdown rendering in the editor: you write and re-read plain text.
- No cross-device sync (yet) — it's deliberate (offline-first), but it's also a real limitation if you want to write on a tablet then re-read on a phone.
How to enable voice dictation
Five-step guide — the app downloads nothing by itself, you stay in control.
- Settings → Voice dictation → Enable voice dictation.
- Choose a model: Whisper Base (57 MB, recommended) or Whisper Tiny (32 MB, faster but less accurate).
- Tap "Download on this phone" — the Android browser opens on the official page huggingface.co/ggerganov/whisper.cpp. Your browser does the downloading, Notes Tech stays without internet permission.
- Once the
.binfile is in your Downloads folder, return to Notes Tech and tap "Select the .bin file". The app verifies the SHA-256 cryptographic fingerprint then copies it into its private area. - Open any note, tap the 🎤 icon in the top bar, speak, tap "Stop". The transcribed text is inserted at the cursor.
You can uninstall the model or switch to another one at any time from Settings → Voice dictation. Panic mode wipes the model and history with a single press.
Open source code
For an app that claims to send nothing, independent code audit is essential — it's the only proof. Notes Tech and its voice dictation module are published under Apache 2.0; you can read, verify and compile them yourself.