Prevon

Pricing

Free today. Paid sync is planned.

The app is free to use — no account, no card. Ghost Sync, optional paid sync between devices, is planned and not available yet; the $4 a month price is a planned price and may change.

  • No credit card
  • No account
  • Cancel anytime once Ghost Sync launches
  • Encrypted vault export

Free

Free today

The full app. Encrypted, AI included, works offline. No account, no card.

Free

No account

required

Apply for the beta

What's included:

  • — locked on your device
  • The AI runs on your device
  • Windows, macOS, Linux, Android, iOS
  • No cap on local notes
  • Works fully offline

Ghost Sync

Not available yet

Same app, plus Ghost Cloud (Ghost Sync and Ghost Backup) so your notes follow you to every device — still encrypted, and designed to be unreadable by us. Not available yet: Ghost Cloud stays off through the private beta. Paid plans are not final; the price shown is a planned list price and may change.

$4

USD per month

planned list price

See how it will work

What's included:

  • Everything in Free
  • Encrypted sync between devices (Ghost Sync)
  • A sealed relay copy for restore (Ghost Backup)
  • Manual encrypted vault backup
  • Documentation

Plan by plan

What each plan includes

Pricing plan comparison
FreeGhost Sync
Platforms
WindowsIncluded in FreeIncluded in Ghost Sync
macOSIncluded in FreeIncluded in Ghost Sync
LinuxIncluded in FreeIncluded in Ghost Sync
AndroidIncluded in FreeIncluded in Ghost Sync
iOSIncluded in FreeIncluded in Ghost Sync
Security
Local encryptionIncluded in FreeIncluded in Ghost Sync
The AI runs on your deviceIncluded in FreeIncluded in Ghost Sync
Built so we can’t read your notesIncluded in FreeIncluded in Ghost Sync
PIN / biometric quick unlock (optional, weaker than the 12 words)Included in FreeIncluded in Ghost Sync
Sync
Ghost Cloud (Ghost Sync, Ghost Backup)Not included in FreeIncluded in Ghost Sync
P2P device pairingNot included in FreeIncluded in Ghost Sync
Cross-device encryptionNot included in FreeIncluded in Ghost Sync
Data
Manual encrypted vault backupIncluded in FreeIncluded in Ghost Sync
Support
DocumentationIncluded in FreeIncluded in Ghost Sync

What privacy looks like

Built so there is little to steal, and little to hand over.

Prevon is designed so that if our servers were compromised, your notes would remain encrypted. No system is immune to every attack.

  • No account on our servers

    There's no username, email, or profile tied to your vault on our servers — so there is no account profile for us to leak.

  • Locked before it leaves

    Your notes get locked before they leave your device. If sync ships, the design means a compromised server should expose only encrypted files.

  • We don’t hold your keys

    We don't hold the keys that decrypt your notes, so we could not decrypt them on request.

Ghost Cloud

Sync across devices, designed without an account address.

Not available yet. Sync is switched off for the private beta, so the app does not sync your notes off your device. Everything below describes how it is built, not what today's build does.

Ghost Sync adds encrypted sync and backup. It works the same way as everything else Prevon does: locked first, built without an account, and optional. What a paid plan meters is a monthly write allowance, not stored bytes, and no storage size is promised.

  • Encrypted before it ever leaves your device

    Ghost Cloud uploads , never your notes. Encryption happens on your device first — our relay is designed never to receive anything readable.

  • No account folder on the server

    By design, your synced notes are not filed under your name or an account ID, so there is no directory that says "these belong to you". Your Recovery Seed is what locates them, on your own device.

  • Billing is separate from your vault

    Once paid Ghost Cloud plans exist (a planned list price of $4 a month, not final), paying will tell Stripe you paid. The aim is that we keep no link between your payment and your notes, and we do not log IP addresses on these paths. See how payment stays separate on the privacy page.

  • Your local vault doesn’t depend on Ghost Cloud

    Ghost Cloud is additive, not load-bearing. Your device is the master copy; a relay copy expires 90 days after its last write unless refreshed, and reading, restoring, exporting and deleting never stop.

Read how the encrypted sync actually works

Not sold here

There's also a Founder Lifetime tier — you can't buy it.

A limited, invite-only Founder Lifetime invite. What it covers inside Ghost Cloud is to be announced, and nobody has yet confirmed how it maps onto the new passes. Ghost Cloud itself is not available in the current build. It isn't for sale on this page or anywhere else: it's earned by testers who actually use the beta and report real bugs, then redeemed with a single-use code once earned.

See how to earn an invite

Your vault, your terms.

The Free tier needs no credit card and no account. Sync is designed to add encrypted cross-device access without an account — it stays off until it has been tested in the beta. Your local data stays on your device and you can export it.

  • No credit card
  • Cancel anytime once paid plans launch
  • Encrypted export

How We Compare

How Prevon is designed differently

A feature-by-feature look at how Prevon is designed, next to popular note apps, based on their published documentation.

FeaturePrevonNotionGoogle KeepApple NotesOthers
Designed so the vendor does not hold your key
On-device AI processing(see note below the table)
No account required
End-to-end encrypted sync (designed; off in the private beta)(see note below the table)
Device-to-device sync, no cloud in the middle (designed; off in the private beta)
No note content sent to a cloud AI (current Prevon build)

✓yes  ·  × no. Verdicts are read from each vendor's own published documentation as of , and describe the default setup. Apple Notes only gains encrypted sync when Advanced Data Protection is switched on. Apple Intelligence runs many tasks on the device, but is opt-in and unavailable in some countries. “Others” is a category rather than one product, so no single answer fits it. On the cloud-AI row: Notion AI and Google Keep’s Gemini features process your content on their servers, and Apple Intelligence sends harder requests to Private Cloud Compute — so, going by that documentation, none of the three keeps AI processing entirely off the network. If any of this changes, it is on us to correct the page.

* Prevon’s sync is switched off in the private beta, so that row describes its design — with default settings your notes stay on your device. Its on-device AI features are in beta. Prevon’s column describes its design and the current private-beta build, not an independent audit.

Read the full comparisons, including where each app wins

Frequently asked questions

Your questions answered.

Is it actually free?
Yes. The app is free to use, works offline, and needs no account. Ghost Cloud (Ghost Sync, Ghost Sharing and Ghost Backup), our optional service, is the only paid part we plan to offer. It is not launched yet; the first launch is planned as a free monthly allowance, and paid plans are not final.
What's the catch?
We don't sell your data, and the vault is designed so we can't read your notes. We plan to make money from people who pay for Ghost Cloud once paid plans exist.
Can I use Prevon without creating an account?
Yes. The Free tier works offline with no account and no Ghost Cloud. Your notes are stored locally and encrypted with keys derived on your device, which the app does not send to us. Ghost Cloud, when available, will add optional encrypted sync and backup.
What happens if I want to leave Prevon?
Your data is yours. You can export your vault as an encrypted backup file from the app. If you cancel Ghost Cloud, the local app is designed to keep working; only Ghost Cloud stops, and cancelling does not delete your local notes. A relay copy expires 90 days after its last write unless it is refreshed, and reading, restoring, exporting and deleting never stop.
What happens if I forget my Recovery Seed?
We cannot recover your Recovery Seed, because we don't have it. This is by design: if we could recover it, so could anyone who compromised our systems. If you lose it and have no unlocked device or backup, we cannot recover your notes. Write it down and store it somewhere safe.
Does Prevon sell my data?
We don't sell your data, and we don't have your notes: they are encrypted on your device. The app does not include analytics trackers or log what you write. Our planned business model is subscriptions, not data. See our Privacy Policy for what the website and any future services collect.
How do you make money without selling my data?
We plan to sell the optional Ghost Cloud service, not what's inside it. A paid plan would meter a monthly write allowance, which has real infrastructure costs. No storage size is promised.
How does the encryption work in Prevon?
Your notes are locked on your device before they are synced anywhere. Your keys are designed to stay on your devices and are not sent to us. The intent is that if someone gained access to our servers, they would see only that they cannot unlock without your keys. Sync is not available yet.
Where does the AI run — on your servers or my device?
On your device, by default and for everything that touches your vault: auto-filing, (exact match and meaning, together), and the AI can — essentially anything you can do to a note, the AI can do too, under the same permission rules. The on-device AI does not send your note content to an external AI service. Cloud AI providers are not built into the app; the only way to send anything to an AI server is to connect one of your own, and nothing is sent unless you do. The model files themselves are downloaded once from huggingface.co, which sees your IP address.
What encryption does Prevon use?
Your vault is locked with keys derived from your 12-word Recovery Seed, and the key-making step is deliberately expensive — which makes brute-force guessing slow and expensive. The encryption is XChaCha20-Poly1305, an authenticated cipher available in libsodium. That is how a standard vault works; a Key Chest vault uses a random key instead, with the words as one way in.
How does end-to-end encrypted sync work?
When you turn on Ghost Sync, your notes are locked on your device before upload and unlocked only on your trusted devices. Sync is not available yet. As designed, our relay would store only sealed data, and we would not hold the keys to read your notes.
Why don't you know how many notes I have, or who I am?
Because that is how sync is designed (it is not available yet). The plan is that synced data is stored without folders, usernames or an account tied to it, so only your 12-word key can locate and unlock what's yours.
Is Prevon's security design documented?
We publish documentation about how our encryption works and how keys are managed. We have not had an independent security audit yet (iOS, macOS, Windows and Linux builds are unaudited too), and we welcome security researchers to review our work.
What happens to my notes if Prevon goes out of business?
The local app is designed not to depend on our servers. If they went away, your on-device vault and AI should keep working. Ghost Cloud users would lose sync and backup but keep their local vault. Keep your own backups and your Recovery Seed.
How do I know you're not just saying all this?
Don't take our word for it. The whole design is documented on the Security page — not vague reassurance, the actual design. We welcome independent security researchers to review it, and people who responsibly disclose a real issue can be credited on our Hall of Fame page.
Does paying for Ghost Cloud reveal my identity?
To Stripe, yes — processing a payment means Stripe necessarily sees your card and billing details, the same as for any company you pay online. We keep no link between your payment and your notes. Our pass desk holds a stable pseudonym and when you paid; the pass issuer sees only a random pass id; storage holds sealed objects at addresses derived from your 12 words. The pass is blind-signed, so the desk never sees the pass id. What is not yet closed: network addresses and timing (Cloudflare, a third party, sees network addresses on every path it hosts; no independent relay operator exists yet), and while few people subscribe, timing could narrow who a pass belongs to. Paid plans are not launched. See the privacy page, “How payment stays separate from your notes.”
If Ghost Cloud is encrypted, why not just store everything in one folder per account like everyone else?
Because encryption protects what's inside a file, not who it belongs to. Prevon's Ghost Cloud design avoids attaching an account folder or user ID to synced data, so there is no obvious label linking data to you. Sync is not available yet.
Does a backup or sync object reveal how much I write, or how often?
We treat that as a real privacy leak worth closing, not an acceptable side effect of encryption. Ghost Cloud objects are designed to be padded to a small set of standard sizes before encryption, so a short note and a long journal entry look the same from the outside. This hardening is still being rolled out and has not been independently audited — see our blog for the current state.
What happens if you're legally compelled to hand over data?
We would comply with valid legal process, as any company must. Because the vault is designed so we cannot read your notes, we expect to have little readable to hand over. We also maintain a warrant canary, a scheduled statement about certain categories of legal demand.