{"package_name":"co.rorystandley.rune","name":"Rune","summary":"Private, on-device encrypted notes. No network, no telemetry, no trackers.","category":"Note","icon_url":"/api/icon/co.rorystandley.rune","latest_version_code":152,"latest_version_name":"0.5.7","apk_url":"/api/apk/co.rorystandley.rune","apk_size":54084199,"apk_sha256":"09e9d5105d6a5c2b9bd89043a26a76bda3f01142081675df0baeb72061b4b589","source_kind":"fdroid-repo","repo_slug":"fdroid-main","last_updated":1792033247,"release_timestamp":1791945534,"description":"Rune is a calm, fast notes app for people who don't want to trust an app with\ntheir data. Your notes never leave your device, they are encrypted at rest, and\nthe app makes no network connections at all. There is no account, no cloud, and\nno sign-up.\n\nPrivacy by construction, not by promise:\n\n* No telemetry, no analytics, no crash reporting, no advertising, no tracking —\n  none, not \"anonymised\", not \"aggregated\".\n* No networking code. Put your device in airplane mode and everything still\n  works. If anything ever tries to reach the network, that is a bug.\n* No account and no server. There is no \"we\" that could hold your data.\n\nReal encryption:\n\n* Your passphrase derives a key with Argon2id; notes are sealed with\n  XChaCha20-Poly1305 authenticated encryption. Only ciphertext is ever written\n  to disk.\n* The passphrase is never stored and is not recoverable. If you forget it, your\n  notes are gone — no reset, no backdoor. That is the price of real privacy.\n* A wrong passphrase simply cannot decrypt your notes.\n\nWhat you can do:\n\n* Create, edit, search, and organise plain-text notes with an Apple-Notes-style\n  layout that adapts from phone to desktop.\n* Auto-lock on inactivity and lock-on-background; the app starts locked.\n* Export an encrypted backup (safe to keep anywhere); plaintext export is gated\n  behind an explicit warning.\n* Capture voice notes — recording stays entirely on your device.\n\nFree and open source under the GNU GPL, version 3 or later. The security-critical code is a small,\ndependency-light, pure-Dart core so it can be read and audited. Releases published on\nGitHub ship with cryptographic provenance (SLSA build-provenance attestations\nand a keyless cosign signature) so you can verify those binaries were built from\nthis source. Builds distributed by F-Droid are built and signed by F-Droid\nitself and are not covered by that provenance.\n\nThis is honest software: it tells you what it does not yet do. See the project's\nSECURITY.md for the threat model and","categories":["Note"]}