Privacy
A private note-taking app that keeps your notes on your devices
Koru is a free, private note-taking app. Your notes are stored on your own devices, not on a company’s server, and you never create an account. Sync between your devices is end-to-end encrypted, usage data stays off unless you opt in, and the app is open source under MPL-2.0, so anyone can check.
What makes a note-taking app private?
A few questions tell you most of what you need to know. Here are Koru’s answers.
| Question | Koru |
|---|---|
| Where are my notes stored? | On your own devices, in Koru’s local store. Not on a Koru server. |
| Do I need an account? | No. No email, no password, no sign-in. |
| Who can read my notes in transit? | Only your linked devices. Sync is end-to-end encrypted, including through the relay. |
| What does the app collect? | Nothing until you agree. If you do: which features are used and how the app runs. Never your documents, their names or what you type. |
| Can I check the code? | Yes. The app is open source under MPL-2.0 on GitHub. |
| Can I leave? | Yes. Export to Markdown or TextBundle, or a full workspace backup, at any time. |
Where are my notes stored?
On your computer. Koru keeps every workspace, document and image in its own store on your device, and saves as you type. Nothing is uploaded unless you link another of your devices, and then it goes to that device, not to a server. To keep a copy elsewhere, Export Backup writes a whole workspace to one .koru file.
Who can read my notes?
You, on the devices you link. Koru does not hold a copy. When two of your devices cannot connect directly, Koru’s relay forwards their traffic, encrypted end to end, and stores nothing. You can switch the relay off on any device.
If you connect an AI tool to Koru’s local MCP server, that tool can read and edit the workspaces on that computer. Koru does not ask per tool, so connect only tools you trust. With a local model, such as one running in Ollama, nothing leaves your computer. With a cloud AI, its provider sees what it reads.
What does Koru collect?
Nothing until you say yes. The first time Koru opens on a device, it asks whether to share usage data. If you agree, it sends which features are used, how well the app runs and basic device facts such as the operating system and screen size, never your documents, their names or anything you type. You can change your answer in Settings at any time.
Importing from Google Docs is the one import that goes online: you sign in with Google, pick documents, and Koru can see only the documents you picked. The sign-in is kept in your system’s secure credential store.
Why does open source matter for privacy?
A privacy policy is a promise. Open source lets anyone check it. Koru’s app code is public under the Mozilla Public License 2.0: you can read what it does with your notes, build it yourself, and run your own build. Official builds are the same source, plus a few settings only Koru holds, such as the key that signs updates.
What can’t Koru protect you from?
Koru keeps your notes off servers, but your device still matters. Koru’s store is not encrypted on disk, and anyone with access to your unlocked computer can open Koru. Turn on your operating system’s disk encryption (BitLocker on Windows, FileVault on macOS) and use a screen lock.
Password-protected notes are not available yet.
Questions
Is Koru end-to-end encrypted?
Sync between your devices is end-to-end encrypted, and your notes are never stored on a Koru server. On each device, notes are protected by your device’s own security, so turn on disk encryption.
Does Koru sell or read my data?
Koru does not have your notes, so it cannot read or sell them. Usage data is opt-in and never includes your content. The privacy policy has the details.
Do I need an account to use Koru?
No. You can use Koru, sync your devices and import your notes without signing up for anything.
How does Koru make money if it’s free?
Koru Cloud, an optional paid service coming soon from $9.99 a month, will add an always-on copy of your workspaces. The app and device-to-device sync stay free.
Is Koru really open source?
Yes. The app is MPL-2.0 on GitHub. Koru Cloud’s server code is not in that repository, but nothing in the app depends on it.
Can I use AI with my notes privately?
Yes. Connect a local model through Koru’s MCP server and your notes never leave your computer.
Related
Last updated