at any point in time, user and only
the user has access to their notes
When I use your app, you can do anything you want to my data. You might promise me that the Javascript you delivered to my browser is treating my data in a certain way. Storing it in encrypted form or whatnot. But that is just a promise. Reality is: you can ship me code that does whatever you like.
Another thing that can be done is that I distribute my application in such a way that its code is directly linked to the open source GitHub repo. It can be done by having some script as the distributable that clones and runs the source code (it's a very bad way though). It would be interesting to know if any other open source project in the privacy space is already doing something extreme like that.
However, that already exists. I can use NextCloud in this manner and the have a note app.
But with YourNote, my other aim is to allow users to also move out of the app in case they don't feel like using it. That's why we have features like "Export Notes" that exports the data in clean, hierarchical `.md` files. This way they always have easy access to their data.
This might be a stretch, since it is not true. You cannot make this guarantee. No one can make that guarantee today.
I wanted to point it out anyhow because it often is overlooked.
Not sure about the line in your copy. Maybe it is possible to state more clearly what the actual privacy and security mechanisms.
Of course not! Don't lie about who has access to your users data and what is possible to do with it. That's not fucking cool. It doesn't matter if there's no way to do it. You don't go making false claims.