What Notelune is designed to protect
Notelune protects private-space originals, thumbnails, sensitive metadata and search information against someone who obtains stored app files or CloudKit assets without the relevant private-space credentials. It also locks private content when the app leaves the foreground and keeps each private space cryptographically independent.
Ordinary note titles and bodies use encrypted fields in your private CloudKit database. Private photos, videos, note attachments, thumbnails and sensitive media metadata receive an additional layer of Notelune encryption before upload.
Encryption and keys
- Each private space receives its own random 256-bit key, and each media item receives a separate random key.
- Media resources are split into authenticated chunks and encrypted with AES-256-GCM. Authentication binds a chunk to its format version, private space, media item and position.
- A passphrase is processed with a salted, versioned PBKDF2-HMAC-SHA256 derivation calibrated to slow repeated guesses. The passphrase itself is not stored.
- Optional Face ID or Touch ID access uses a device-only Keychain item that requires a device passcode and is invalidated when enrolled biometrics change. Notelune never receives biometric data.
iCloud sync and file integrity
Sync uses the private CloudKit database of the Apple Account signed in on your device. Notelune does not operate an account system or a media storage server. A file is not described as protected in iCloud until CloudKit confirms its upload.
Encrypted chunks are authenticated before use and the reconstructed original is checked against its expected digest. Encryption, decryption and repair use transactional temporary files: an interrupted or invalid operation does not replace a known-good file or leave a partially decrypted file at its final location.
Recovery and a way out
Every private space has an independent recovery key. Notelune can use it to identify the correct space without listing private spaces first, download available encrypted originals and verify them before access is restored. You can rehearse recovery from Settings without changing your passphrase.
You can also export original files, create a standard password-protected ZIP for use outside Notelune, or create an encrypted portable backup that preserves a complete private space for restoration in Notelune. Keep recovery keys and backup passwords somewhere safe outside the app.
Alternative notebook view
Notelune can temporarily show only the ordinary notes you choose. You may activate that view from Settings or by entering an optional presentation phrase in Search Notes. The phrase is represented by a device-only Keychain verifier, is not synced and never unlocks a private space. It should not reuse a private-space passphrase.
This feature reduces casual exposure when lending an unlocked device. It does not hide the Notelune installation from system inspection and is not a separate encryption boundary.
Important limits
- If both a private space's passphrase and recovery key are lost, Notelune support cannot decrypt it.
- A compromised device may expose content while that private space is open. No app can prevent every screenshot, screen recording or photo taken with another camera.
- Notelune reduces how long passphrases and decrypted metadata remain in memory, but does not claim perfect memory erasure on Apple platforms.
- iCloud availability, account access and storage capacity remain services supplied by Apple. Keep an independent backup of anything irreplaceable.
Verification status
Notelune is not described as independently audited. Internal automated tests cover cryptographic test vectors, separation between private spaces, incorrect keys, damaged and truncated chunks, malformed Live Photo and RAW containers, recovery checks, interrupted writes and portable-backup validation. Physical-device acceptance and longer fault-injection campaigns are separate release checks and are not replaced by those automated tests.
Security update history
September 5, 2026 — pre-release hardening
Encrypted-file writes and repairs became transactional. Chunk-size and trailing-data validation were tightened, portable-backup relationships gained stricter validation, and imported backups now authenticate every encrypted original before creating local records.
September 4, 2026 — recovery and format coverage
Recovery rehearsal gained isolated download verification. Independent encrypted note attachments, paired Live Photo resources and RAW pairs received additional integrity and cross-private-space tests.
Report a security issue
Responsible reports are welcome at notelune@outlook.com. Include the Notelune version, Apple platform, steps to reproduce and the impact you observed. Do not send real private media, passphrases, recovery keys, Apple Account credentials or unencrypted backups.
Please allow time to reproduce and correct a report before publishing technical details that could put other users at risk.