What does privacy-first mean?

That privacy is a property of how the app is built rather than a promise in its policy. A privacy-first notes app cannot read your notes, because they never reach it in readable form. A privacy-focused one usually can, and undertakes not to.

How is that different from privacy-focused?

Policies bind a company as it exists today. They can change with new management, new investors or a legal order. Architecture does not: if the provider never holds the key, there is nothing to change its mind about.

Does Dash collect analytics or telemetry?

No. There is no analytics SDK, no usage reporting and no crash telemetry carrying your content. With sync off, the app makes no network requests for your notes at all.

What data does Dash store about me?

Without sync: nothing, because there is no account and no server. With Dash Sync on: an email address if you signed in for billing, the subscription status tied to it, and encrypted blobs the relay cannot read. Not the notes, not the titles, not the keys.

Does this help with GDPR or similar rules?

Usually, yes, in the simplest possible way: an app that does not collect personal data has very little to handle, disclose or delete. If you are deploying Dash in an organisation with formal obligations, treat that as a question for your own compliance people rather than a claim we make on your behalf.

Dash Notes

Free on iPhone

Guide

Privacy-First, and How to Check the Claim

Every notes app says it respects your privacy. The useful question is whether it could read your notes if it wanted to.

Get Dash for Mac Read on

Updated September 2026 · Dash team

Privacy has become a marketing category, which makes the word almost useless on a product page. Nearly every notes app claims it. Very few are built so that the claim would survive a change of ownership, a new business model, or a court order.

This guide is a short test you can apply to any notes app, including Dash, and an honest account of what Dash stores.

Policy versus architecture

A privacy policy is a promise about behaviour. It is worth something, and it binds the company that wrote it, for as long as that company exists in its present form. Standard Notes, Evernote and Notion all have reasonable policies.

Architecture is a statement about capability. If notes are encrypted on your device with a key the provider never sees, no policy change, acquisition or subpoena makes the content readable to them, because there is nothing to hand over. That is the difference between “we will not” and “we cannot”.

Five questions to ask any notes app

Does it work with no account? An account is a permanent record of you attached to the content.
Does it work with the network off? If not, your notes must be on someone’s server for the app to function.
Who holds the keys? “Encrypted at rest” usually means the provider does. Look for end-to-end, or for local-only.
Can I read the code? For a security claim, an unverifiable assertion is just advertising.
Can I leave? Export in a standard format, without a subscription, or the privacy is conditional on continued payment.

How Dash answers them

No account. Install it and write. An email is involved only if you buy the Mac app or subscribe to sync, and it is used for billing and entitlement, not attached to note content.
Works offline. Notes are files on your device; nothing is uploaded unless you turn sync on.
You hold the keys. Locked notes use AES-256-GCM with keys derived on the device. With sync on, the vault key never leaves your devices and the relay stores ciphertext.
Open source under MIT. The whole app is on GitHub.
Export any time to Markdown, PDF, DOCX or an encrypted backup, subscription or not.
No telemetry. No analytics SDK, no usage reporting, no crash data carrying your content.

Where Dash is not magic

Local storage means backups are your job. A device that is compromised by malware exposes what you can see, encryption or not. Metadata such as note titles and timestamps is not hidden by locking a note. And if you choose to use sync, an email address and a subscription record exist, because payment requires an identity even when the content does not.

Any page claiming a notes app solves all of that is selling something. The reasonable goal is to remove the company from the trust equation, which is achievable, rather than to remove every risk, which is not.

Frequently asked questions

Keep reading

Private notes appNotes that stay on your device, with no account.What is AES-256 encryption?The cipher, the key derivation and the salts, in plain language.Offline-first appsWhy an app that works without a server is a different kind of software.

Cannot read your notes, rather than will not.

$14.99 once on Mac. Free on iPhone.

Get Dash for Mac App Store