Privacy Policy

Last updated: October 24, 2026

AnkyLock is a notes app that encrypts your notes on your own device. This policy explains what data the AnkyLock apps (the desktop app and the web app at app.ankylock.com) and this website handle, and why. In short: AnkyLock has no servers that receive your notes or your Google data, and nobody but you can read your notes.

AnkyLock is made by Onur Kangal, an individual developer. Questions about this policy go to privacy@ankylock.com.

Your notes

Notes, their titles, folder and category names, and vault names are encrypted on your device with AES-256-GCM, using a key derived from your vault passphrase. The passphrase and the key never leave your device and are never stored. Encrypted data is kept on your device (in the desktop app’s database, or in your browser’s storage for the web app) and, if you sign in with Google, in your Google Drive as described below. AnkyLock cannot read your notes, and cannot recover them if you forget your passphrase.

Google data

Signing in with Google is optional. Without it, AnkyLock works on one device only. If you sign in, AnkyLock asks Google for these permissions and uses them only as described:

• Your identity (openid, email): to know which Google account the backups belong to. The web app keeps your email address in your browser as a sign-in hint until you sign out; it is not sent anywhere else.
• The app’s own folder in your Google Drive (drive.appdata): to store your vaults’ encrypted backups in a hidden folder that only AnkyLock can see. AnkyLock cannot see, read or change any other file in your Drive.

Your Google sign-in tokens stay on your device: in memory in the web app, and in your operating system’s keychain in the desktop app. They are sent only to Google. The data AnkyLock reads from Google is used only to provide the app’s backup and sync features to you; it is never sold, never used for advertising, never transferred to anyone else, and never read by a person. Your vault key is never derived from your Google account.

AnkyLock’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Google sees the encrypted files in your Drive: their names (made of random identifiers), sizes and when they change, but not their contents. Google’s handling of your account is covered by Google’s Privacy Policy.

Instant sync with your own relay

The desktop app can optionally connect to a relay server that you run, to pass encrypted changes between your devices instantly. AnkyLock does not operate a relay. A relay you configure receives encrypted changes it cannot read, routing details (which notes change and when), and your short-lived Google sign-in token, which it uses to check that the connection is yours.

Removing your data

• In the app, you can delete a vault from your device, delete it from Google Drive, or delete all of AnkyLock’s data from Google Drive and revoke its access in one step.
• You can also revoke AnkyLock’s access at any time in your Google Account settings.
• Uninstalling the desktop app or clearing the web app’s site data removes the copy on that device.

This website

This website (ankylock.com) and the web app are static files served by Cloudflare. They set no cookies and use no analytics, ads or trackers, and they load no scripts, fonts or other files from third parties. The website remembers your theme and language choice in your browser’s local storage, which never leaves your device. Like any web host, Cloudflare processes technical data such as your IP address to deliver the pages and protect them from attacks; see Cloudflare’s Privacy Policy. The download links lead to GitHub, under GitHub’s Privacy Statement.

Children

AnkyLock is not directed at children under 13 and does not knowingly collect any data from them; it collects no personal data from anyone.

Changes

If this policy changes, the new version is published here with a new date, and the history of every change stays visible in the public source code.

Contact

Write to privacy@ankylock.com. To report a security problem, follow the security policy.