Can the Company Access My Notes?

Short answer

In many note products, yes, the company can technically access readable notes even if policy says that access is restricted. In a stronger privacy model, the goal is that the company does not need that ability.

Why this matters

There is a difference between:

• "we do not usually read customer notes"
• and
• "the system is designed so we do not need a normal path to readable notes"

The second statement is stronger.

What to ask

• Can the backend decrypt note bodies?
• Can support tools inspect readable content?
• Are previews, indexing, or search handled server-side?
• Is recovery possible without user-held secrets?

The useful way to think about it

Do not ask only what the company promises. Ask what the architecture allows.

A practical takeaway

Company access is lowest when the product stores ciphertext, keeps keys on the client side, and avoids admin-side content workflows.

Policy vs. architecture

A privacy policy can promise restraint, but architecture decides what is possible.

If the company controls the decryption path, then it has the ability to access note content even when that access is supposed to be rare or exceptional.

What to check in practice

• where the encryption keys live
• whether search happens before or after encryption
• whether support can see plaintext in any workflow
• whether exports and backups remain readable outside the app

A practical takeaway

Company access is least concerning when the company can operate the service without needing to see the content. That is the difference between a policy promise and a real technical boundary.

Commercial use is a separate question

Even if support staff cannot read your notes, the company may still try to extract value from surrounding activity data through analytics, model training, product improvement, or third-party sharing. Sometimes that is described as anonymized data, but anonymization is only as strong as the process behind it.