Privacy
Built so we can't read it
Your notes hold wills, policy numbers and family names. We treat them the way a password manager treats passwords.
What happens to a note
- Your device seals each note and marker with AES-256-GCM, one file per item.
- The key is locked with your passphrase (Argon2id) and your device's own key store. The passphrase never leaves your device.
- Sync, whether it's ours, OneDrive or Dropbox, only ever moves the sealed files.
- The web app unlocks in your browser. Our server sends sealed files and never sees the key.
What we can see
| Item | Trailmark sync | Your OneDrive or Dropbox |
|---|---|---|
| Your email address | Yes, to sign you in | No |
| How many items, their size, when they changed | Yes | No |
| Note text, titles, dates, trail names | No, sealed | No, sealed |
| Your passphrase | Never | Never |
If you forget your passphrase
Devices that are already unlocked keep working, and you can set a new passphrase from any of them. If every device and the passphrase are gone, we can't recover the vault. That's the cost of us not being able to read it, so export a copy now and then.
What we don't do
- No ads, and no trackers in the apps.
- No AI reading your vault on our servers. Guide, when it ships, only sees the text you paste into it.
- No selling or sharing of data.
This website
The website counts page visits with its own analytics, and visitors in the UK and EU are asked first. Change your choice under Cookie settings at the bottom of any page.
Questions about privacy: write to us.