Support

Please reach out to us at hi@serenity.re

Categories
• Privacy
• Account
• Applications
• Infrastructure
• Open Source
• Technical information

What data is end-to-end encrypted?

The content of all notes, contact names and device names.

What data is not end-to-end encrypted?

While all content is end-to-end encrypted there is so called meta data generated for the whole system to work.

For example when you share a note with someone the server won't know the content, but is aware that you two collaborate together on one note.

Here are few examples of meta data:

• Amount of notes
• Amount of updates per note
• Who your contacts are (based on IDs)

We try to reduce the amount of meta data that is generated, but it takes time and effort.

Why are there no passwords to authenticate?

Your devices have stored secret keys which are used to authenticate them yourself with the server using public-key cryptography.

This is one of the reasons why it's recommended to connect multiple devices. Losing your one and only key would mean that your account is lost.

How can I restore my account?

Unfortunately if you loose all your linked devices all your notes, contact and device names can't be restored.

For now we highly recommend to link multiple devices to avoid your data being unrecoverable. In the future we want to establish a secure backup and restore mechanism.

How can I export all my data?

Unfortunately the only way is to copy & paste each note manually. In the future we want provide an export functionality.

How can I delete my account?

Find the "Delete User Account" button in the application's settings area.

Why is there no web client on the roadmap?

We might build one in the future, but first we want to focus on mobile and desktop client.

When will the desktop apps be ready?

We hope to have the macOS and Windows latest by mid 2022.

In case you have an Apple computer with an M1 processor you can install the iPad app on your macOS.

Where are the servers hosted and why do we use this services?

At the moment Heroku is used for the servers and the database. Heroku is a US company, but the database and all instances are located in Europe.

While Heroku offers a great product we are considering to migrate our services to a European hosting provider in the long run.

Why does server location matter if the content is end-to-end encrypted?

While the content itself is encrypted meta data such as who shares documents with whom and when updates took place exist.

This can be valuable information and that's why we care to store the encrypted data in a secure location.

Can I synchronize my data via iCloud?

No, it's not possible and we don't intend provide this functionality. It's important to us to offer the service across multiple platforms. An integration into iCloud doesn't align with this goal.

Why the .re top-level domain?

.re is administered by AFNIC which also operates the .fr top-level domain. Since we are a European company it was important to us to use a top-level domain managed by a European organization.

Is it Open Source?

You can find the source code for the iOS/Android application here.

The server code is not open source yet and won't be for a forseeable future.

In order to verify the security of Serenity Notes it shouldn't be necessary to expose the server code. The clients should never accept a note, contact or device that hasn't been added or verified by the user.

How are notes stored?

Notes are stored as a base64 encoded string of a Yjs CRDT document. To learn more about Yjs visit https://github.com/yjs/yjs.

Why implement a custom protocol and not rather use thre Matrix protocol?

Matrix is a great protocol for messaging systems, but when exchanging data to represent a document receiving and decrypting every change would be very ineffecient.

Our protocol, while still naive, is already more effiecient in most cases. We are always encrypting the full CRDT data structure (with tombstones for deleted sections) and sending it to the server. Other clients then only need to fetch the last message. While still very inefficient it works already quite well when not too many devices exchange smaller documents.

There are further optimization possible like using snapshots in combination with change messages. In order to implement such optimization we would need to fork Matrix or convince them to adapt the protocol. Instead we decided develop our own protocol with the believe that this will allow us better to experiment on the protocol and evolve it faster.

That doesn't mean the Matrix Protocol can't have such optimisations and we would be happy to share our findings and collaborate.

Why is the protocol not documented?

Its something we want to do, but other topics are more important to us right now.

Why is the protocol not federated like Matrix?

While we like the idea of federation it creates a lot of overhead for engineering. We feel it would be too effort at this point and rather want to focus on privacy and good user experience.