Private
Notes in Private are locked with your passphrase. If you lose it, those notes are unrecoverable — there is no reset, and we do not hold a copy of the key. On a Library with Private notes enabled, use the same passphrase on each device. The passphrase is not sent to the server. Desktop can remember the data key on that device. It does not save the passphrase. A new passphrase must be at least 12 characters. Ela also rejects common passwords and simple patterns when you turn Private notes on or change the passphrase. The check runs on the device. A Library that already uses a shorter passphrase can still unlock. The cloud holds ciphertext, not the note. Sync carries sealed title, tags, and body (e2ee:v2 envelopes; older e2ee:v1 envelopes still open until a device finishes reseal) plus an opaque blob. It does not skip Private. Slug, ciphertext size, and timestamps stay visible. An e2ee:v2 payload moved to another note is rejected. Search, cloud MCP, and note reads exclude these notes and say Private notes not searched. The coverage JSON still lists private/ in excluded_folders.
Private plaintext does not go to Postgres, cloud responses, logs, caches, Voyage AI, or OpenAI. Plaintext for a note that moves into Private is removed from the searchable note, its versions, chunks, and embeddings. That purge does not rewind provider backups.
On the web, unlock with the passphrase or a recovery key. The key stays in that tab’s memory and locks on idle, sign-out, reload, or Lock. Search in that tab can include the notes you have unlocked. That search does not ask the server to match Private text. The web app does not keep an offline note cache.
Local vs cloud
That search exclusion is tested on every release. A longer account of who can see what is on Security.
Subprocessors
These providers handle data for the hosted service.
Voyage AI and OpenAI are used only for Pro libraries. Notes in Private are never sent to either provider. Ela does not write Ask Ela prompts or answers into its logs.