- Category
- Notes · SaaS alternative
- Cost
- Freemium
- Country
- Canada
- Licensing
- Proprietary
Pros and cons
- +Local-first: notes are plain Markdown files on disk, no lock-in
- +End-to-end encrypted Sync with a vault password the user holds, AES-256-GCM with scrypt key derivation
- +No account required for the core app, which works fully offline and ships no telemetry
- +Free for personal and commercial use, with a voluntary Commercial license that funds development
- +Large plugin and theme ecosystem, plus graph view, backlinks, canvas, and Bases
- −Closed source; trust in the app rests on the company's word, not auditable code
- −Sync and Publish are paid add-ons, and bring-your-own-cloud sync on mobile is fiddly
- −Community plugins have full file and network access once enabled, so a malicious one can read the whole vault
- −No native realtime collaboration
- −No published third-party security audit of the Sync encryption
Privacy notes
Notes live as plain Markdown files in a vault folder on the user's device. The desktop and mobile apps are local-first: by default they store no telemetry and send no note content anywhere, with the only outbound calls being an update check and the community plugin and theme browser, both of which can be disabled. Obsidian Sync (optional, paid) end-to-end encrypts vaults with AES-256-GCM, deriving the key from a separate vault password via scrypt and HKDF; the company sees only ciphertext, and Obsidian publishes a guide so users can verify the encryption themselves. Obsidian Publish is opt-in and uploads selected notes to a vendor-hosted site. The publisher is Dynalist Inc. of Oakville, Ontario, so Canadian privacy law (PIPEDA) applies to the paid services. Community plugins run as JavaScript inside the Electron app with full vault and network access; new vaults open in Restricted Mode, but once a plugin is enabled it is not sandboxed.
Comments (0)
No comments yet. Be the first.