Notes leak differently from images
A vault can encrypt note contents at rest exactly as it encrypts a photo. The difference is what happens during use: text is trivially copyable, and the paths it takes out of the vault are ones images rarely use.
Editing text involves a keyboard, often a third-party one. Copying involves the system clipboard, which may synchronise across devices. Both sit outside whatever the vault controls.
The keyboard is part of the threat model
Third-party keyboards receive what you type in order to function, and some request full network access for features like cloud prediction. Even ordinary text can be sensitive, so consider the content and the keyboard's permissions before typing it.
Where a note genuinely matters, prefer a trusted keyboard whose permissions you have reviewed. System origin alone is not a guarantee, and a third-party keyboard is not automatically unsafe.
Clipboard and previews
Copying text out of a vault ends the vault's control of it immediately, and the clipboard may persist far longer than the moment of use — and in some ecosystems reach other devices entirely.
Notification previews and app-switcher snapshots are the other common path, since both can render note text without any unlock.
Working with private notes
- Decide whether the note belongs alongside the files it relates to.
- Prefer the system keyboard when the content is genuinely sensitive.
- Avoid pasting secrets through untrusted apps.
- Lock the vault immediately after reading or editing rather than backgrounding it.
- Confirm notes are included in your tested encrypted backup, since they are easy to overlook.
Habits that undo the encryption
- Leaving sensitive text sitting on the clipboard.
- Exporting a note into an unencrypted notes app “temporarily”.
- Assuming a search index never surfaces the text elsewhere.
A fictional example
Jonas starts with a non-sensitive test: “Decide whether the note belongs with related private files.” Next, Jonas follows the second check: “Avoid pasting secrets through untrusted apps or keyboards.” This fictional scenario demonstrates the decision process; it is not a report of product testing.
Common mistakes
- Leaving sensitive text on the clipboard
- Exporting to an unencrypted notes app
- Assuming search indexes never reveal text
What this workflow does not change
- Leaving sensitive text on the clipboard
- Exporting to an unencrypted notes app
- Assuming search indexes never reveal text
Questions people ask
Can NullVault store notes?
Yes on Android; private text notes are part of the current product proposition.
Should passwords go in a photo vault?
Use a dedicated password manager for credentials; a private note vault serves a different purpose.