Privacy & security
Private note plaintext and attachments stay local, and opt-in encrypted release packages are designed so KinSignal's backend cannot read selected text-note contents.
Local-first private notes
Notes are created and encrypted on the user's device. Private notes are not shared by default.
The backend never receives plaintext note titles or bodies, credential content, attachments or file metadata, vault keys, or recipient private keys.
Encrypted release packages
For individual owners, Private Note Release is an opt-in Advanced feature. Separately entitled Business accounts may also have access. Only selected text notes are encrypted on-device into recipient-specific packages for selected eligible recipients. Attachments and file metadata are never included. The backend stores ciphertext and policy metadata only.
Preparing a package does not release it when the first missed-check-in alert is sent. The earliest eligible time is whichever is later: the alert threshold plus the configured unresolved days, or the alert threshold plus the owner cancellation window. If acknowledgement is required, each recipient must acknowledge their relevant alert; acknowledgement does not itself immediately release the note.
Release packages are checked hourly, so availability may occur later. A check-in before release cancels applicable pending alerts and packages. Content already released or viewed may not be fully retractable. The trusted contact private key stays on their device, and the backend cannot read released notes.
No note content in alerts
Private note content and attachments are never included in local reminders, email alerts, or push notifications. Lock-screen push notifications use generic wording that asks the recipient to open KinSignal securely.
Example alert wording
“KinSignal alert — Open KinSignal to review an account update.”
Trusted contact released notes
Trusted contacts can view released notes only after the backend authorises release. Decryption happens locally on the contact's device.
If the contact changes device and does not have the original private key, they may not be able to open older released notes.
Friendly device message
“This note cannot be opened on this device. Ask the sender to re-share or contact support.”
Delivery cannot be guaranteed
A missed check-in does not confirm an emergency. Notification and release delivery are not guaranteed and may be delayed or unavailable due to device, network, email, push notification, account, or app conditions.
Understand the full KinSignal flow
See how check-ins, trusted contact alerts, and optional encrypted note release fit together.