We start every request with refusal.
Government and legal requests
Every government or legal request for user data starts from refusal. No request is fulfilled by standing policy, by a support agent, or by any automated process. Every single one is reviewed personally.
A request is only even considered once its legal basis is unambiguous and verified: a valid, binding court order we have no lawful remaining way to challenge. Even then, disclosure needs an individual, personal sign-off on that specific request, case by case, every time. Disclosure is limited to the absolute minimum a court compels. This bar does not move depending on which country is asking — a request from the United States, the European Union, China, or anywhere else is held to the exact same standard.
Request log
What we can and can't hand over
- Notes is encrypted on your device before it leaves it. Even a court order we couldn't fight off wouldn't get its contents: we have no way to read it.
- Passwords are never stored in readable form, so there's nothing there to hand over either.
- What we do hold, and exactly why, is spelled out in the Privacy Policy. None of it is sold or shared for advertising.
Everything else that keeps your data safe is on Security.
Responsible disclosure
Found a real security issue? Email security@liecosys.xyz directly. It reaches a person, not a ticket queue. Give us enough detail to reproduce it, and you’ll hear back from an actual human, as fast as we can.
No bounty program yet. What you get instead: public credit right here, once your report's fixed and confirmed, if that's your thing. The only ask back — give us a fair shot to actually fix it before it goes public anywhere else.
Machine-readable contact: /.well-known/security.txt
Visibility is Liability
This is a company-wide rule, not an engineering-only one. The standards we build on are public, and our security is meant to hold even when everyone knows exactly what we use. What stays private is narrow: the anti-abuse playbook that spots attackers, internal tooling, and anything that would put a real person at risk.
Inside the company, everything is written down in full. See what we publish.
LIECOSYS Pays
Every commitment on this page costs something — slower development, zero ad revenue, less convenience. That trade-off was decided up front, and LIECOSYS carries it. Security and freedom were never up for negotiation.
Read the full principle on LIECOSYS Pays.
Questions people ask
Every request starts from refusal. Only a valid, binding court order we have no lawful way left to challenge is even considered, and even then we hand over only the minimum it compels. Every fulfilled request is published here. None so far.
Not in any form anyone can read. Notes is encrypted on your device before it leaves it, and we can’t read it.
No. Every country’s request is held to exactly the same standard.
Only what we hold in readable form, which the Privacy Policy lists in full. Never the contents of your notes or files.
Not yet. What you get instead: public credit once your report is fixed and confirmed, if you want it. We ask for a fair window to fix it before it goes public.