Every account here is encrypted by default — there's no toggle, and no way to opt out of it. You set your passphrase once, right after your first sign-in. This is what it actually does — no more, no less.
What's actually encrypted
Note titles and text, task titles and descriptions, habit names, book and watch titles and notes, and event titles — the things you actually write. Dates, due times, done/not-done status, and recurrence stay readable server-side, since reminders and your Today dashboard genuinely need to know when something's due, just not what it says.
The key never leaves your browser
You set a passphrase — separate from your Google sign-in — used only on your device to unlock your data. It's never sent to our server in any form, not even briefly. Without it, what's stored is unreadable, including to us.
Forgetting it means it's gone — on purpose
There's no "reset your passphrase" support request that gets your data back, because that would mean we could read it too. You get a one-time recovery key when you set this up — it's the only other way in. Lose both, and that content is permanently unrecoverable. That's not a bug; it's what makes the first two points true.
Sharing a note is an explicit exception
If you turn on public sharing for a note, that note's content is exported as plain text to the link, on purpose — anyone with the link can read it, the same as any other shareable link. Nothing else changes; the rest of your data stays exactly as protected as before.