Can I choose my own balance between convenience and privacy?

Yes, deliberately. Not everyone is defending against the same threats, so the account model is a ladder rather than a single dogma. Every rung keeps your notes end-to-end encrypted; what changes is who holds the key and what we know about you.

The convenient end: sign in with Google, Apple, or GitHub and pick "Keep it simple & convenient" when asked. We store your recovery phrase for you, encrypted at rest on our server, so any device signs in with that login alone and there is nothing to back up or lose. The honest tradeoff: we know the email behind that login, and a fully compromised server could in principle expose the stored key. If your realistic threat is losing your own credentials rather than a targeted breach, that is a sensible trade.

The middle: sign in with Google, Apple, or GitHub but pick "Maximum security & privacy". Your phrase never touches our servers and the encryption is fully zero-knowledge; new devices need the phrase or a QR scan from a device that is already signed in. We still necessarily know the email behind that login, but we could not read a single note even under compulsion.

The private end: skip the logins entirely and use only the 12-word phrase. No email, no name, no identity, and paired with an anonymous Pro purchase, even paying leaves no name anywhere. In exchange, key custody is entirely yours: lose the phrase with no signed-in device left, and nobody can help.

You are not locked into the rung you picked. Settings > Security > Your Phrase shows both modes side by side with what each one costs, and you can move either way whenever you like. Switching to self-custody deletes our stored copy and asks you to retype three of your twelve words first, since the people most likely to click it are the ones who never wrote them down. Switching back uploads the phrase again and takes an explicit choice. Both directions are signed with your own account key, so a stolen session cannot change your custody mode. And every rung can add the local layers on top: PIN app lock, biometric unlock, and per-note protection.