# PrivacyNotes is run by a US company. Does that put my notes at risk?

Your notes are encrypted on your device, and with [self-custody](https://privacynotes.app/help/threat-model-levels/) the server holds nothing that opens them. What you write reaches it only as ciphertext, so a legal order in any country gets only ciphertext, wherever the company is registered. Check it: the code is [open source on GitHub](https://github.com/LifetimeLabsHQ/PrivacyNotes.app), and your browser's network tab shows your words leave only as ciphertext.

Lifetime Labs LLC is a US company because that was the quickest way to put our projects under one name. Nobody on the team lives in the US, and your synced notes are stored in Zurich, Switzerland.

What the law can reach is the data the service needs: your public key, sync timestamps, storage size, short-lived server logs and, if you connect Google, Apple or GitHub, that email. With "Keep it simple & convenient", your recovery phrase is stored on our server too, and it opens your notes. Settings > Account > Key custody switches you to self-custody. [What PrivacyNotes can see](https://privacynotes.app/help/what-can-you-see/) lists more.

## Read the source

- SECURITY.md: What the server sees -> https://privacynotes.app/docs/security.md (source: https://github.com/LifetimeLabsHQ/PrivacyNotes.app/blob/main/SECURITY.md#what-the-server-sees)
- VERIFY.md: Tier 1: one minute, no tools -> https://privacynotes.app/docs/verify.md (source: https://github.com/LifetimeLabsHQ/PrivacyNotes.app/blob/main/VERIFY.md#tier-1-one-minute-no-tools)

---
Source: https://privacynotes.app/help/us-company