Privacy and security: where your notes are stored

Guest mode: notes stay in your browser

If you use NextNotePad without signing in, your files, folders and settings are saved in your browser's own storage (IndexedDB and local storage) on the device you are using. They are not uploaded to a NextNotePad server.

Two consequences are worth knowing:

• Your notes are only on that browser on that device. Another browser, a private window or another computer will not see them.
• Clearing your browser's site data for nextnotepad.com deletes them. Export a ZIP backup from time to time if the notes matter to you.

Signed in: notes live in your own Google Drive

When you sign in with Google, each workspace becomes a real folder under NextNotePad.com/Workspaces in your Google Drive, and each note is a real file in it. Your settings, recent files and favorites are kept in a small configuration file in the same NextNotePad.com folder. Your Drive is the place your notes are stored; NextNotePad does not keep a separate copy of their contents in its own database.

NextNotePad's database holds only what is needed to run your account: your Google account ID and email address, the sign-in tokens used to reach your Drive on your behalf, account flags, and (if you turn it on) a hashed app-lock password.

What the drive.file permission means

Google offers apps different levels of access to your Drive. NextNotePad requests the narrow drive.file permission, which only covers files the app itself created. It cannot browse, read or change the rest of your Drive.

You can remove NextNotePad's access at any time from your Google Account's security settings, under third-party connections. Your files stay in your Drive when you do.

Encrypt individual files with a passphrase

Any file or folder can be locked with a passphrase. When you lock it, the content is encrypted inside your browser using AES-256-GCM, with a key derived from your passphrase (PBKDF2 with 210,000 iterations). Only the encrypted text is saved, whether that is in browser storage or in Google Drive. To read the file again, you enter the passphrase and it is decrypted locally.

Keep the passphrase safe. The encryption is designed so that the stored data is unreadable without it.

Lock the whole app with a password

Signed-in users can set an app password from Settings. You can choose when it is asked for: each time you start a new browser session, on your first visit of each day, or on every visit and page refresh. You can also lock automatically after a period of inactivity and lock the installed app when it is reopened. The password is stored as a salted scrypt hash, never as plain text.

When the installed app goes to the background, NextNotePad covers the screen so the operating system's app switcher does not show a preview of your notes.

Tools that send text elsewhere

Most features run entirely in your browser. The exceptions are the optional AI tools (Fix Grammar & Spelling, Markdown generation and the prompt assistant). When you use one, the text you selected is sent to an AI provider, either Google Gemini or Claude, to be processed. Do not use these tools on passwords, personal data or anything confidential.

Voice typing uses your browser's built-in speech recognition. In some browsers, such as Chrome, the browser itself sends audio to its vendor's speech service.

Quick recommendations

• For text you never want in the cloud, use guest mode, and export a ZIP backup.
• For notes you need on several devices, sign in and keep them in your Drive.
• For anything sensitive, in either mode, lock the file with a passphrase.
• On a shared computer, set an app password, or use guest mode in a private window and close it when done.

Questions about saving? See How to save notes online.