Remnote stealing user data from windows desktop app

Posted by Lucine
Apr 1, 2026 at 06:54 PM

It happened a while ago, and I just thought of sharing it now for the first time and I did in another comment, but this deserves its own topic. Chris, feel free to delete the other comment since I can’t do so. Here’s the comment in full:

It might sound unbelievable, but I was using Remnote Desktop on Windows and found that it was secretly scanning content of my PC and uploading to Remnote in their own cryptic formats, with folders full of random string names IIRC, as well as an “extensionless” database full of content from my browser and local storage. It’s been a while and the exact details are fuzzy, but I’ve kept the files as proof as well as to analyze further when I have more time. I promptly uninstalled it, but kept those folders that were in the process of being uploaded to Remnote. All were cryptic extensionless files that looked like routine app folders but were definitely the result of Remnote scanning device content and uploading content to them secretly. The folder kept getting bigger and bigger and was filled with what looked like random string name files. it was also making “history” and “preferences” extensionless files that were hundreds of MB big - had nothing to do with anything I put in Remnote. It turned out to be an extensionless file that can be read when changing to .sqlite and contains ALL of the file names on my local downloads directory, browsing history, bookmarks, etc and I haven’t even looked at it in detail yet. All of this was getting silently uploaded to remnote at the time of removal of the app. I have the files to prove it.

I even found a mention of someone who discovered and was questioning something similar on one of the user forums (they hadn’t yet realized the extent of the malicious activity) but their questions were deflected in an expert way by the Remnote team which made me realize they were deliberately doing it and it was no accident. I’m not up to date on computing terminology to explain all this anymore, but it’s something you can easily verify if you’re actively looking. I recommend you give it a try and let me know what you discover. Believe me or not, I don’t care, but I’m never installing that spyware crap on my PC. Who knows how nefarious these people are. I even stopped using the browser app, since I’m not good at detecting when apps are trying shady stuff via webapps.

Posted by satis
Apr 2, 2026 at 06:33 AM

Based on how modern software (specifically Electron-based apps like RemNote) functions, I believe you are almost certainly misinterpreting standard application behavior as malicious spying.

Most modern productivity apps use LevelDB or similar key-value storage systems. Folders filled with files named things like 000005.ldb, MANIFEST-000001, and CURRENT are perfectly normal - this is how the app stores your notes so it can search them instantly. It isn’t “scanning your PC”; it’s just how the database engine organizes the data you actually put into the app.

RemNote is an Electron app, meaning it runs on a version of Chromium, and Electron apps often create their own “User Data” directories that mirror a browser’s structure. If you used RemNote’s internal “web link” features or its integrated browser components, the app would naturally create a History or Web Data file. So, it’s exceedingly unlikely RemNote was “stealing” Chrome history and far more likely you were looking at the app’s own internal cache or accidentally pointed the app to a local directory, causing it to index file names for its own “file attachment” or “search” features.

Also, in a world of cloud sync there’s no reason to jump to the conclusion that the app is “secretly uploading”—every time you edit a note Remnote syncs those changes to the server so you can access them on your phone or web browser. It’s **cloud syncing**.

When nontechnical users ask “Why is this app using 2GB of space and creating weird files?” developers often give highly technical answers about “database indexing,” “garbage collection,” or “Electron cache.” To a user already primed for a conspiracy, a technical explanation often feels like a deflection. Since we don’t know what was asked, or answered, it’s not possible to determine whether ‘deflection’ was taking place or devs were being too technical (or, conversely, dumbing down the answer for mass consumption) I won’t speculate further on this.

I suggest you post this to a forum where experienced users of Remnote (epecially technically experienced ones) can better evaluate or explain what you’re seeing. Try https://www.reddit.com/r/remNote/

Posted by satis
Apr 2, 2026 at 06:37 AM

A couple of additional thoughts.

I wanted to explicitly mention “Local-only Knowledge Bases.” RemNote allows users to host their data locally rather than on the cloud. If a user accidentally toggled this or selected a broad parent folder (like Documents), the app would attempt to index everything in that folder to make it “searchable” within the notes. This is a very common “oops” moment that looks like a “scan” to an untrained eye.

Also, if you ever used the “Import,” “Upload,” or “PDF Annotation” features in RemNote, the app creates a pointer to those file paths. And since RemNote is built on Chromium, it uses the same engine as the Chrome browser. If you ever logged into a site via an embedded window in the app or used its internal browser to clip a web page, the History and Web Data files would record that specific activity… but not your entire computer’s history.

Modern OS sandboxing makes it incredibly difficult for a standard productivity app to silently scan your entire hard drive and upload it without triggering massive CPU spikes or Firewall/Antivirus warnings. What you likely saw was a mirrored cache of the actions you took within the app itself.

Back to topic list