Security

Local-first by design

Your notes are plain markdown files stored on your own disk. There is no central server holding your knowledge base, which means the most common target, a big cloud database of everyone's data, does not exist. If you never turn on sharing or sync, your content never leaves your computer.

Open source and auditable

Baalda is open source under Apache-2.0. Anyone can read the code on GitHub to see exactly what it does with your files. You do not have to trust a claim on this page; you can check the source yourself.

Data in transit

This website is served over HTTPS. When you opt into real-time collaboration or a managed sync backend, the content you share is sent over encrypted connections so it is protected while moving between your devices and teammates. If you self-host, that traffic flows through infrastructure you control.

What we collect

As little as possible. The website runs no analytics and no tracking cookies, and the contact form sends email from your own client rather than posting to a server. The full picture is in our privacy policy.

Your part

Because your files live on your own disk, a lot of your security is in your hands: keep your operating system and Baalda updated, use full-disk encryption on your device, and keep backups. For shared spaces, only invite people you trust and remove access when someone leaves.

Reporting a vulnerability

If you find a security issue, we want to hear about it. Please email naveedharri@gmail.com with the details and steps to reproduce. Give us a reasonable chance to fix it before sharing it publicly, and please do not run tests against other users' data or anything that would disrupt the service.

For non-sensitive bugs, a public GitHub issue is fine and often fastest. Machine-readable disclosure details are published at /.well-known/security.txt.

Contact

Security questions? Reach us at naveedharri@gmail.com or through the contact page.