Security and privacy
What stays on your machine, what does not, and how that is enforced.
Nothing leaves unless you send it
DunneNote has no telemetry, no analytics, no crash reporting to a server, and no account system. There is no background process phoning anywhere. A notebook is a folder on your disk and stays one.
The exceptions are the ones you configure: a backup destination you point at deliberately, and external links you choose to open in your browser.
Link checking is offline
The check that flags a suspicious link runs against a blocklist and heuristics bundled with the application. No link you paste is sent anywhere to be checked. This costs freshness — a bundled list ages between releases — and the trade is made on purpose, because the alternative is transmitting a record of every link you handle to a third party.
Credentials
Backup destination credentials are held in the operating system’s own credential store rather than in the notebook or in a configuration file. They do not travel when you copy a notebook to another machine, which is the correct behaviour: the notebook is portable, the authority to write to your cloud account is not.
Encryption
Content sent to a backup destination is encrypted before transmission, so the destination stores ciphertext. The cryptography uses well-reviewed Rust implementations rather than anything hand-rolled.
The notebook on your own disk is not encrypted at rest by DunneNote. Full-disk encryption — FileVault, BitLocker, LUKS — is the right tool for that, and it protects everything else on the machine at the same time.
Auditability
Operations log their intent before they run and their result after, with enough context that a reader can reconstruct what happened from the log alone. The standard being aimed at is the one an auditor would apply to a financial system: not “an error occurred” but what was attempted, against what, with what outcome, and under which run.
Logs are written locally. They are not transmitted.
Reporting a vulnerability
Please do not open a public issue. Email support@dunnecorp.com with the details and it will be handled directly.