Myths Busted: \"If It's Encrypted, the Company Can Still Read It\"

You've probably heard the line before.

Someone shrugs and says, "Sure, it's encrypted… but the company can just unlock it whenever they want." It sounds plausible. After all, if your notes live on someone else's servers, don't they hold the keys to the kingdom?

It's one of the most common myths we hear about privacy in note-taking apps—and it's time to set the record straight.

Not all encryption is created equal

There are two big camps:

Server-side encryption (the kind most apps use)

Your notes get scrambled on the company's servers using keys they control. It protects against random hackers snooping on disk, sure. But the company itself? They can read everything. They have the keys. They can hand them over if asked. Your "private" thoughts aren't really private.

Client-side encryption (also called end-to-end or zero-knowledge encryption—the kind TreeNotes uses)

Your notes are encrypted on your device before they ever leave your phone or computer. The encryption keys are generated from your password and never touch our servers. We never see them. We never store them. We literally can't read your notes—even if we wanted to.

Think of it like this

Imagine writing a secret letter, sealing it in an envelope, and locking it with a padlock only you have the key for. You then mail the locked box to a storage company. They can store it, move it around, keep it safe from thieves—but they can never open it. Only you can. That's client-side encryption in a nutshell.

At TreeNotes, we built our entire architecture around this principle from day one.

• Your password never leaves your device. When you log in, we don’t receive your password—not even as a hash. You prove you know it with a one-time proof that can’t be replayed or used to unlock your notes. So even in a breach, there’s nothing we could hand over that would decrypt your data.
• The key that actually decrypts your notes is never sent to our servers—not at signup, not at login, never. It’s derived in your browser and stays there.
• Every note, every branch of your thought tree, every connection you make—all encrypted locally before syncing.
• Even we can’t peek. Not during a support ticket. Not for "debugging." Not under any circumstances.

This isn't just a nice-to-have feature. It's foundational to why people choose TreeNotes when privacy matters.

Because your late-night reflections, your most honest journal entries, your wildest ideas that might change everything—those deserve better than "trust us." They deserve real, mathematical protection. The kind where we can't read them, even if a government knocks on the door or a data breach happens.

So next time someone says, "If it's encrypted, the company can still read it," you can smile and reply:

"Not here. Not with TreeNotes."

Your thoughts deserve real protection. Start free on TreeNotes—client-side encrypted from day one.