Private. Encrypted. Yours.

All encryption code is open and available for inspection on GitHub, in the @reborn/crypto package.

But you don't need to read code to see it in action. In re/notes, click the E2E badge in the header of an open note — this launches X-Ray mode, which shows your data side by side: on the left what you see (decrypted content), on the right what the server sees (encrypted noise in iv:ciphertext format). You can also open your browser's developer tools (F12 → Application → IndexedDB) and verify that only encrypted values are stored in the local database.

Yes. The code is fully open and available on GitHub under the GNU AGPL-3.0 license. Anyone can review it, verify the encryption security, and propose changes.

On a Hetzner Cloud server in Germany — in the European Union, under full GDPR jurisdiction. Reborn Apps is a project of a European non-profit foundation from Poland, and all infrastructure stays in the EU.

Moreover, the Zero Knowledge architecture ensures GDPR compliance “by design” — the server stores only encrypted data it cannot read. This means that even in the event of a server breach, an attacker would only obtain encrypted noise with no way to decrypt it.

Thank you! We prioritize responsible disclosures and appreciate the community's help in maintaining the project's security.

Preferred channel — GitHub Security Advisory: click “New draft security advisory” and describe the issue, reproduction steps, and potential impact. Alternatively, you can email [email protected].

Please don't open public issues for security vulnerabilities — we need time to release a fix before details become public.

Response time: acknowledgment within 48 hours, initial assessment within 7 days, fix as soon as possible depending on priority. Full policy is described in the Security Policy.

Yes. The code is open source, and you can run the apps on your own server (self-hosting) at any time — with no fees or limits. That will always be the case.

The easiest way, however, is to use the official instance at reapps.eu, maintained by Reborn Foundation — a non-profit organization from Poland. It's free, managed by us, and regularly updated — this is the option we recommend for most users.

If you'd like to support development with a voluntary donation, we'd be very grateful, but it's not a condition for using the apps.

Yes. After logging in on another device, your data is automatically synchronized. Sync happens regularly in the background, but you can also trigger a manual sync by clicking the sync option in the app's sidebar footer.

Data is always transmitted in encrypted form — the server only acts as an intermediary storing ciphertext.

Yes. Both apps are Progressive Web Apps (PWA) built with an offline-first architecture. All data is stored locally in IndexedDB in your browser — it's the primary data source, not the server.

You can create, edit, and browse tasks and notes without an internet connection. Changes will sync automatically when the network returns. The apps can also be installed on your phone's or computer's home screen — they work like native apps.

Yes. In re/notes you can export:

• Markdown (.md) — individual notes or all at once,
• JSON — full backup preserving encryption.

You can also import Markdown files, entire folders, and even Obsidian structures.

In re/task, data export and import is available in JSON format.

Yes. You can create internal links between notes in several ways:

• Type [[ — autocomplete with a list of your notes will appear,
• Keyboard shortcut Ctrl+Shift+K — opens a note selection dialog,
• Note menu → “Copy link” → paste in another note,
• Editor toolbar — click the note icon in the toolbar.

Links use internal identifiers (UUID), so they don't break when you rename a note. Clicking a link takes you directly to the target note. This feature also works offline.

Yes, you can insert an image URL conveniently via the option in the note editor toolbar or manually using standard Markdown syntax: ![description](image-url).

For privacy protection, you can choose the external image loading mode:

• Ask (default) — the app asks before fetching,
• Always — loads automatically,
• Never — doesn't load (prevents tracking by external servers).

In re/notes, each account has 100 MB of storage for encrypted notes — that's more than it might seem. Notes in Markdown format are very lightweight: a typical note takes only 5–50 KB. In practice, this means room for thousands of notes, depending on their length and number of saved versions in the edit history. Each note can have up to 10 saved version history entries, and you can always check your current storage usage in the app settings.

In re/task, the size of a single task (title, description, metadata) is small enough that the limit poses no practical constraint — even accounts with thousands of tasks use a fraction of the space of a single extensive note.

Reborn Apps are developed by a non-profit foundation and offered for free — we cover server costs ourselves. If there is demand for more storage and community support makes it possible, the limits will be increased.

2FA is not required, but we strongly recommend it. The apps support the TOTP standard — time-based codes generated by apps like Aegis, Authy, or Bitwarden Authenticator.

After enabling 2FA, you can generate 8 one-time recovery codes (format: XXXXX-XXXXX) — they'll let you log in if you lose access to your authenticator app (but they require knowing your password — they don't replace it). Your account is protected against brute-force attempts — after 5 failed attempts, login is blocked for 15 minutes.

Due to end-to-end encryption, we cannot recover your password — the server doesn't store it in any form and cannot decrypt your data. We also don't store your email address, so there's no way to send a reset link. Losing your password means permanent loss of access to your data — this is a deliberate design decision protecting your privacy.

That's why we strongly recommend using a password manager, such as Bitwarden or KeePassXC (free and open source), to securely store your password.

Recovery codes are only for regaining access when you lose your 2FA app — they do not allow you to recover a forgotten password.

Honest answer: you will lose access to your account. There is no “backdoor,” admin panel, or manual 2FA reset procedure. This is a deliberate decision — in Zero Knowledge architecture, the server cannot serve as a “last resort” because it cannot verify your identity beyond your password and 2FA code.

That's why when enabling 2FA, make sure to generate and save recovery codes — for example, printed and kept in a safe place, separate from your password. Don't store them together with your password in the same password manager — compromising one location would mean losing both safeguards. One used code will let you log in and reconfigure 2FA — but you still need to know your password.

In the app settings, go to Security → Delete account. After confirming with your password, all your data will be permanently and irreversibly deleted — notes, tasks, folders, tags, sessions, tokens, and settings. The operation cannot be undone.

Deletion is cascading — no “orphaned” records remain in the database. This implements the right to erasure (Article 17 GDPR), and the Zero Knowledge architecture means that even before deletion, the server could not read your content.