Your words are yours. We made that a guarantee.

When you protect a message with a password, the encryption happens on your device, before anything is sent to us. Our servers receive and store only the scrambled result. This is what zero-knowledge means: we hold your messages for you, but we are technically unable to read them — and so is anyone who might pressure us to.

There is no master key on our side, no admin backdoor, and no support tool that can peek inside an encrypted message. That is not a policy we promise to follow. It is an inability we built in on purpose.

We do not invent our own cryptography. Messages are encrypted with AES-256-GCM, the same authenticated encryption standard used by banks and governments, running on the Web Crypto API built into your browser.

The encryption key is derived from your password using PBKDF2 with SHA-256 and 150,000 iterations, with a fresh random salt and initialization vector for every message. In plain terms: even two identical messages encrypted with the same password produce completely different ciphertexts.

The password that protects a message is never sent to our servers and never stored by us. You hand it to your recipients yourself — told in person, written down, or printed on a physical card with the password hidden under a scratch-off sticker.

This has an honest consequence: if a password is lost, we cannot recover the message content for you. No reset link, no support escalation. That trade-off is the price of a real zero-knowledge guarantee, and we think it is worth it.

Many services use a "dead man's switch": if you stop answering emails, they assume the worst and release everything. PostNotes never releases anything because of silence. Your messages are delivered only after a person you trust confirms the moment has come, through a confirmation link you configured.

You decide who holds those links, how many confirmations are required, and how long the grace period is before anything is actually released. During that window you are notified and can cancel with one click — so even a mistaken or malicious confirmation does not expose a single word.

Your account itself is guarded independently of your messages: sign in with a password or an emailed magic link, and add two-factor authentication (TOTP) for an extra layer. Connected third-party accounts, such as a social profile for a farewell post, have their access tokens stored AES-256-GCM-encrypted at rest.

All traffic between your browser and PostNotes is protected with TLS, and our infrastructure runs on established providers with independent security programs.

PostNotes complies with the GDPR. You can export your data and delete your account — and with it your messages — at any time. We do not sell your data, we do not mine your content, and unencrypted drafts are never used for anything except showing them back to you.

What little we must store in readable form — your email address, delivery addresses for your recipients, billing records — is the minimum needed to deliver your messages when the time comes.