A local-first notes-and-todos app for macOS. Markdown notes, a full task system, and an Eisenhower matrix — all in a hardened shell. No account. No server. No one else's cloud.
// Feature-complete · 279 tests · MIT licensed · v1.0.5
Most notes apps ask you to ship your thinking to someone else's server. Cinder takes the other path entirely.
Every note and task lives in an encrypted SQLite database on your own machine. Nothing to sign up for, nothing to phone home to.
Sandboxed renderers, validated IPC, and an AES-256 database whose key never leaves the macOS Keychain. Hardening isn't a setting — it's the architecture.
The data model is sync-ready — UUIDv7 IDs, timestamps, soft deletes. When sync arrives it'll be CRDT-based and end-to-end encrypted, not a naïve REST afterthought.
Notes, tasks, and prioritisation — woven together and reachable entirely from the keyboard.
A WYSIWYG editor built on TipTap, with full-text search and frictionless capture.
.md and .html; export single notes or your whole libraryEverything you'd expect from a serious task manager — priorities, projects, labels, recurrence — with a parser that reads plain English.
"Submit report tomorrow 5pm p1 @work"today & p1, @work & overdueSee every active task sorted by urgency and importance — then drag to re-prioritise in a single drop.
Fuzzy-match across navigation, projects, labels, filters, and actions. Notes, tasks, the matrix, exports — all without lifting your hands off the keyboard.
Every IPC channel is a public API and validated as such. These rules are enforced by Electron itself or rejected at lint time — not left to discipline.
SQLite via SQLCipher, AES-256. The database key lives only in the macOS Keychain.
sandbox, contextIsolation on; nodeIntegration off. The renderer never touches Node.
Zod schemas check each IPC message before it reaches business logic, plus an assertMainFrame() on every handler.
eval, new Function, stray dangerouslySetInnerHTML, and renderer Node built-ins are rejected at lint time.
shell.openExternal is gated behind an https:-only allow-list. CSP set via response headers.
All export, backup, and attachment I/O runs in the main process via native dialogs. The renderer never sees a path.
TypeScript end to end, strict everywhere, with pure tested logic kept framework-free.
Cinder is open source and free. Grab the latest release, or read every line of the source for yourself.