Skip to content

NotallyXYZ

Install NotallyXYZ

Download Zapstore

Download
QR code for zapstore.dev/download
  • Scan the code with your phone’s camera
  • Tap Download anyway if the browser warns about the file
  • Allow your browser to install unknown apps if Android asks
  • Open Zapstore and finish the onboarding

Open NotallyXYZ in Zapstore

Open
QR code to open NotallyXYZ in Zapstore
  • Scan the code to open NotallyXYZ in Zapstore, or search for it there
  • Tap Install, and Download if Zapstore asks you to confirm the developer
  • Confirm in Android’s install dialog. Allow Zapstore to install unknown apps if Android asks

Claimed by the developer

Turtlecute cryptographically proved they hold the key that signs NotallyXYZ. The claim is a signed proof on Nostr, tied to the certificate below.

Developer
Turtlecute
Developer key
npub1acpsfwhq63nehv6rgl8rkxuqfq3x9wvp90gvp40pnf0zg3gy8d6ss564p8
Signing certificate
81776480a2afa0aced066d0b44631dd2159e267d10555a8cefcabd5c9ef9b48b
APK checked by
relay.zapstore.devIt read the APK and found it signed with this certificate before listing the release.
Claim published
Oct 31, 2026
Valid until
Oct 30, 2028
Proof event
a12c3dedda737651f01b4e8085e1afaf31fec8846b458f261378b389b0e38d16in relay.zapstore.dev
How trust works

Minimal notes app with end-to-end encrypted sync to your own server. Supports notes, lists, attachments, and reminders. Changes merge safely across devices without accounts or trackers.

NotallyXYZ is a fork of NotallyX, the minimal notes app. It adds one feature: sync between your devices, through a server that you run yourself. The server keeps only ciphertext. It never gets the key, the note text, the label names or the file names.

Sync is off by default. Without sync, the app is NotallyX and makes no network connections. No account, no trackers, no Google Play Services. There are also native apps for macOS, Linux and Windows.

  • Notes and lists: formatting, links, lists with subtasks, colours, labels, pins, archive and bin.
  • Attachments: images, files and audio. They sync too, encrypted like the notes.
  • Reminders with repetition.
  • Safe merge: changes from two devices merge field by field. If two devices change the text of the same note, the app keeps both versions.
  • One key, no account: a random 256-bit sync key connects your devices. The app encrypts each note, label and attachment with AES-256-GCM before it leaves the device.
  • From NotallyX: app lock with biometrics or PIN, optional database encryption, automatic backups, a home screen widget, and import from Google Keep, Evernote and Quillpad.

Summary generated by Zapstore from source.

Original description, as the developer published it.

Zap NotallyXYZ

Zapping anonymously. Sign in to zap with your identity.

Sats go to npub1acpsf…s564p8, the developer who signed the app’s certificate proof.

Amount in sats

Stacked in

Latest release

Oct 31, 2026

Claimed app No Google servicesSource available · GPL-3.0-only

Uses the microphone to record audio attachments.

Permissions

  • Notifications POST_NOTIFICATIONS Send you notifications
  • Microphone RECORD_AUDIO Record audio To record audio attachments.

Release notes

Fixes

Fixes for lost edits, sync and backups on all platforms. The Android APK is half the size.

  • Android: the APK is 7.6 MB (was 14.7 MB), because it has only the ARM libraries. The app no longer makes two full backups each time it starts. The app keeps only 3 backup files, so these extra backups deleted the older daily backups. When you turn on backup on save, the app now makes one full backup, so that backup has all attachments. Auto-remove of deleted notes now removes old notes from the bin. Before, it did not remove a note. Sync setup, Disconnect and Delete server data now finish when you turn the screen or close Settings. Before, Create account could lose the sync key, and Delete server data could stop the app. A sync that started now finishes when you close a note or switch apps. Before, Settings could show "Sync failed: JobCancellationException", and the next sync could make a "(conflict)" copy of the note. Screen turns and app switches no longer add more live sync connections. In a checklist, "Paste and new line" now opens the new item below the last pasted line. TalkBack now reads the translated labels of checklist items, not debug names such as "Delete3".
  • macOS: the app saves the open note when you quit, log out or restart. Before, the text that you typed after the last pause was lost. A new note now has the keyboard focus in the title, so you can type at once. Delete Checked Items now asks first. When the same note is open in two windows, an edit from another device is no longer lost when you close one window. A new edit, sleep or a switch to another app no longer stops a sync that runs, so an attachment upload does not start again from zero. The live update no longer sends requests in a fast loop while a sync runs or after a sync fails. It now waits 5 seconds to 5 minutes. If the app cannot read the sync key from the Keychain or cannot open its local data, the setup screen now tells you why. It also tells you that a new connection deletes the changes on this Mac that are not synced yet. Dates show "just now" in place of "in 0 seconds".
  • Linux and Windows: the app saves the open note when you close the window. Before, the text that you typed after the last pause was lost. If the app cannot read the sync key or open its local data, the setup screen now tells you why, with the same warning as on macOS. A connected app no longer shows the setup screen at start by mistake. In confirm dialogs, Cancel now has the focus, so the Enter key cannot empty the bin or delete a note or the server data by accident. In the Reminders dialog, Done now adds the reminder that you filled in. In setup, a second Enter no longer starts a second connection or makes a second account. Cards with the "Fit content" size fit their content again. The note grid keeps its scroll position, and the editor does not reload when you uncheck a list item. The app no longer keeps a global reference to the decrypted notes in the web view.
  • Server: account creation accepts a request body of 64 KiB at most (was 32 MiB). Before, some large requests without a login could use all the memory and stop the server. If the file of a stored attachment is missing, the server now answers 404, not 500. Before, Android sync stopped at that point each time. When the server stops, it now waits up to 10 seconds for the requests that run. At start, it removes the temporary files of uploads that did not finish. Log lines now start with the timestamp.

Update

  • Android: install NotallyXYZ-android-1.1.4.apk over 1.1.3 (same signing key). The APK is for ARM devices only (arm64-v8a and armeabi-v7a). It does not install on x86-only devices, for example Intel emulators and some Chromebooks.
  • macOS with Homebrew: brew upgrade --cask notallyxyz.
  • Linux and Windows: built by GitHub Actions and attached a few minutes after the release.
  • Server: ghcr.io/turtlecute33/notallyxyz-server:1.1.4 (also :1.1 and :1). No change to compose.yaml. The sync protocol and the stored data do not change, so you can update the server and the apps in any order.

Android APK SHA-256: 5ba2bd1095467dfb68fc42a3fe509cae4d36010cc2cb38bf9d793c5cef39fccf Signing certificate SHA-256: 81776480a2afa0aced066d0b44631dd2159e267d10555a8cefcabd5c9ef9b48b

Check: sha256sum -c SHA256SUMS --ignore-missing. Desktop files: gh attestation verify <file> -R Turtlecute33/NotallyXYZ.

Comments

Loading comments…

See more

Get NotallyXYZ the private way

Updates checked on your device, and every release verified before it installs.

Get Zapstore for Android

  1. Tap Download APK below.Scan the code with your Android phone’s camera.
  2. If Android asks, allow your browser to install unknown apps.
  3. Open Zapstore and finish the onboarding.
Download APK

v2.0.4 · 71.2 MB · Android 10+

Verify the download

On a computer, run shasum -a 256 <the file you downloaded>. It should print: b13e01319fecf0b3ba1fd60132758bd0fa08a235836c52d44fddb412cf1b7137

If you have zsp, Zapstore’s publishing tool, zsp utils extract-apk <the file you downloaded> works too. Its hash should be the same SHA-256: b13e01319fecf0b3ba1fd60132758bd0fa08a235836c52d44fddb412cf1b7137

On the phone, AppVerifier should show this signing certificate: 99e33b0c2d07e75fcd9df7e40e886646ff667e3aa6648e1a1160b036cf2b9320

Source code All releases and notes

Get zsp

  1. Download the file for your computer.
  2. Make it executable and put it on your PATH.
  3. In your project folder, run zsp.

Have Go? This does the same:

go install github.com/zapstore/zsp/v2/cmd/zsp@latest
macOS, Apple silicon Linux, x86-64 Linux, arm64

v2.0.1 · macOS and Linux

Verify the download

On your computer, run shasum -a 256 <the file you downloaded>. It should print the SHA-256 for the one you chose.

macOS, Apple silicon · 18.6 MB 99018fb9744e5ace2b44557550dc333496239912c0e9b1137266d4922c803346

Linux, x86-64 · 23.8 MB 1ef5373f8ecd9ba63d2c3fab98abb0d31b2244a2aac31b3749fb205c7d5f5b38

Linux, arm64 · 22.1 MB e421005ee47cba58293dce4277bb784e4cfe706dbbcb8617d671629d0238be18

Source code All releases and notes