Reflect
Reflect is a networked note-taking app that links every note through backlinks and adds a built-in AI assistant. Notes are end-to-end encrypted, and a free open-source Mac edition now stores everything as local Markdown files.
What is Reflect?
Reflect is a note-taking application built around backlinks rather than folders. Any note can point at any other, and the result is a personal graph, what the company calls a second brain, that grows denser the more you write in it. The homepage sets out eight commitments: speed, networked notes, an iOS app, end-to-end encryption, calendar integration, one-click publishing, instant capture and frictionless search.
The AI layer is native rather than bolted on. Highlighting text and pressing cmd J opens an AI palette that lists action items and key takeaways from meeting notes, generates an article outline from scattered thoughts, summarises an article or fixes grammar. Users switch between GPT-4o and Claude 3.5 Sonnet in preferences, while Google's Gemini powers the chat feature, and ready-made prompts can be cloned, edited and saved as your own. Advanced search adds a conversation over your notes, filtered by tag, so you can ask what you were thinking about last week. Voice memos are transcribed with Whisper, and the audio file is deleted once the text lands in the note.
Security is the second differentiator. Notes are encrypted on the client with XChaCha20-Poly1305 using a password that never reaches Reflect's servers, the encryption library is published as open source, and the design was independently audited by Doyensec. The trade-off is stated plainly: lose the password without a recovery kit and the notes are gone.
Around that core sit a REST API with OAuth 2 and PKCE, a beta MCP server that lets Claude Code, Codex and Cursor read and write notes from a terminal, Zapier automations, Readwise and Kindle sync, browser extensions for Chrome and Safari, and calendar and contact integrations with Google, Outlook, Office 365 and Apple.
Reflect App LLC is an indie team of four working from Austin, Texas, which publicly rejects the venture-scale playbook in favour of sustainable growth. In July 2026 it released Reflect Open, a free, MIT-licensed rewrite that keeps notes as plain Markdown on your own disk and syncs through iCloud or Git. The original subscription app continues alongside it, still maintained.
What it does
- Capture daily notes and link them into a searchable graph of backlinks
- Ask an AI assistant to summarise, rewrite, outline or pull action items out of selected text
- Chat with your own notes and follow each answer back to the note it came from
- Transcribe voice memos straight into the day's note
- Clip web pages and sync Kindle and Readwise highlights
- Turn meetings from Google Calendar, Outlook or iCal into structured notes
- Read and write notes from Claude Code, Codex or Cursor through the MCP server
When to use Reflect / When not to
A quick filter to help you decide if Reflect is the right fit.
When to use Reflect
- Daily writers and journallers who want one fast place for meeting notes, long-form drafts and stray thoughts
- Researchers, students and heavy readers who capture web clips, Kindle highlights and Readwise material and need to find them again months later
- Privacy-conscious professionals who want client-side end-to-end encryption on their notes rather than a vendor promise
- Apple-first users working across macOS and iPhone, online or offline
- Developers and AI power users who want a REST API, an MCP server for Claude Code, Codex or Cursor, and the option of bringing their own model key
When not to use Reflect
- Windows and Android users, since neither platform has a client and the vendor gives no release date
- Teams looking for shared workspaces, roles or per-seat billing, none of which the site describes
- Buyers with procurement requirements, as there is no data processing agreement, no SOC 2 or ISO certification and no stated hosting country
- Developers who need to read notes back through the API, which the encryption keeps append-only
- People with advanced or unusual note-taking workflows, an audience the vendor openly says it does not target
How to use Reflect
A typical end-to-end flow, from setup to results.
- Sign up on the website and choose a password, which doubles as your encryption key and never leaves your device
- Save the recovery kit downloaded during sign-up, because without it a lost password means lost notes
- Start the 14-day trial, then subscribe to keep using the hosted app
- Install the clients you need: macOS for Apple Silicon or Intel, the iPhone app from the App Store, the iPad build through TestFlight
- Add the Chrome or Safari extension to clip web pages and sync Kindle highlights
- Connect Google Calendar, Outlook, Office 365 or iCal to pull meetings and contacts into your daily note
- Write, then highlight a passage and press cmd J, or control J on Windows, to open the AI palette
- Clone an existing prompt, edit it and save your own version, using the selected-text placeholder to mark where your highlight goes
- Optionally add your own OpenAI or Anthropic API key in profile preferences to lift the daily token cap
- For automation, create OAuth credentials for the REST API, or enable the MCP server and register it from the command line in Claude Code, Codex or Cursor
Pros & Cons
Pros
- End-to-end encryption is implemented client-side, independently audited by Doyensec and backed by a published open-source library
- You choose the model, GPT-4o or Claude 3.5 Sonnet, and can bring your own API key to remove the daily token cap
- One plan at one price, with nothing to compare and no features held back for a higher tier
- A full refund is offered with no questions asked
- Reflect Open is MIT-licensed and stores notes as plain Markdown, so the archive can outlive the company
- A real automation surface: REST API, MCP server for coding agents, Zapier and a command line
- A free online academy and full documentation rather than a thin help centre
Cons
- No Windows or Android client, and the vendor gives no release date for either
- A single paid tier on the hosted app, with no cheaper entry point for occasional use
- AI usage is capped at 10,000 tokens a day on free accounts and 100,000 on paid ones unless you supply your own key
- The API is append-only, since encryption prevents notes from being read back through it
- No data processing agreement, no Article 27 representative, no security certification and no disclosed hosting country
- Losing the password without a recovery kit destroys the notes permanently, and the vendor admits the encryption ultimately requires trusting the JavaScript client
- Two products now share the brand, and Reflect Open is still beta, has no web or iPad version and adds no encryption layer of its own
Pricing & Plans
There is no permanent free plan on the hosted application: access begins with a 14-day free trial, after which a single subscription applies at USD 10.00 per month, billed annually. A permanent free option does exist in another form, since Reflect Open for macOS, released in July 2026, is free and open source under the MIT licence, and the iPhone build is free during its TestFlight phase, although the vendor states that it expects to charge for it eventually. Included AI usage is capped at 10,000 tokens per day on free accounts and 100,000 on paid ones; supplying a personal OpenAI or Anthropic API key removes that cap, with provider charges billed separately.
- networked note-taking
- Chrome and Safari web clipper
- Kindle offline sync
- end-to-end encryption
- Kindle highlights sync and the iOS app
- after a 14-day trial
- Reflect Open for Mac
- free and open source under the MIT licence
- Reflect Open for iPhone
- free during the TestFlight beta
- with the vendor expecting to charge for it later at a price and date not yet announced
- 10
- 000 tokens per day on free accounts
- 100
- 000 on paid accounts
- and no cap when you supply your own OpenAI or Anthropic API key
Data, GDPR & hosting
A consolidated view of how Reflect handles your data.
GDPR overview
Implementation is real but partial. The privacy policy, last updated 20 March 2025, carries a dedicated GDPR chapter: Reflect App LLC names itself the data controller, lists the six legal bases it relies on, and undertakes to guarantee access, rectification, objection, erasure, portability and withdrawal of consent. Rights are exercised by contacting the company, and the right to complain to a national supervisory authority is stated explicitly. What is missing is equally concrete. No Article 27 representative is designated, no data protection officer is named, no data processing agreement is published and no hosting country is disclosed. The company, its offices and its processing sit in the United States, and the policy asks European users to accept that transfer through their own consent rather than through a named safeguard.
Who owns the data?
Reflect App LLC names itself the data controller, yet on the original app it deliberately limits what it can control. Notes are encrypted on the client with XChaCha20-Poly1305 using a password that never leaves the device, so the servers hold a blob the company cannot read; images and attachments are covered too. Permanent export is one of its published values. Reflect Open goes further still: there is no Reflect account and no Reflect-hosted database, notes are ordinary Markdown files on the user's own disk, and the source code is MIT-licensed, so the archive survives the company that made it.
Reuse rights
Note content stays with the user. Reflect states that it does not share user data with third-party tools, including AI models, that it does not train on customer data, and that it stores neither the requests nor the responses exchanged with model providers. Users may export, edit and republish their own notes without asking permission, and Reflect Open already keeps them as plain Markdown files any other editor can open. Two caveats matter. Text sent through the AI palette leaves the device for OpenAI, Anthropic or Google, and Reflect warns that those providers may use the prompts as training data under their own terms. Account-level personal data, unlike note content, is used for running the service, contacting users, analytics and targeted advertising.
Data retention & training
Hosting summary
Reflect publishes neither a hosting country nor a hosting region. The company operates from Austin, Texas, and its terms are governed by United States law, so US jurisdiction is the working assumption. The privacy policy says only that information is processed at the company's operating offices and wherever the parties involved in processing are located, and that data may be transferred outside the user's own jurisdiction; European users accept that transfer by accepting the policy rather than through a named safeguard. What sits on those servers, for the original application, is an encrypted blob. Notes, images and attachments are encrypted on the client before upload, so the hosting location determines where ciphertext rests rather than where readable content lives. Contacts, calendar data and account information are not covered by that encryption. Reflect Open changes the question entirely: there is no Reflect account and no Reflect-hosted database, notes are Markdown files on the user's own machine, and synchronisation runs through iCloud Drive or a Git repository the user controls.
Where Reflect works
Country-level availability.
Not available in
Things to keep in mind
Risks and trade-offs to weigh before adopting Reflect.
- The password is the encryption key, and Reflect cannot reset it. A user who skips the recovery kit at sign-up, exactly the moment when nobody is paying attention, can lose years of notes for good
- End-to-end encryption is not absolute: the vendor states plainly that you ultimately have to trust the JavaScript client, which it updates from time to time
- Every use of the AI palette sends the highlighted text off your device to OpenAI, Anthropic or Google, and Reflect warns that those providers may use the prompts as training data under their own terms
- A second brain can quietly replace the first. Outsourcing summarising, outlining and recall to a model is convenient, and it removes the effort that made the notes worth keeping
- Frictionless capture invites hoarding: clipping every article and highlight builds an archive nobody rereads, and the search meant to save you becomes one more thing to maintain
- The privacy policy mentions targeted advertising and Facebook remarketing, which sits awkwardly beside the encryption-first positioning and is easy to miss
- Two products now carry the same name with different security models and platform coverage, so choosing the wrong one, or splitting notes across both during the transition, is a genuine risk
Setup & Integrations
Technical difficulty
Everyday setup is straightforward: create an account, pick a password, install a client and connect a calendar through OAuth. The one step that deserves care is not technical but consequential, namely keeping the password and the recovery kit, since Reflect can restore neither. Intermediate effort begins if you add your own OpenAI or Anthropic key, which means opening a billing account with that provider. Advanced use is genuinely technical: the REST API ships no official bindings, and the MCP server must be enabled in settings then registered from the command line in Claude Code, Codex or Cursor.
Deployment
Apps stores
Integrations
Behind Reflect
Fundraising
Social
Resources
All the official URLs gathered for verification and reference.
Alternatives
Tools that compete with or complement Reflect.
Frequently asked questions
Which AI models does Reflect use?
Can Reflect read my notes?
Is my data used to train AI models?
Is there a free version?
How much does Reflect cost?
Is there a Windows or Android app?
Can I get my notes out?
Does Reflect have an API?
What happens if I lose my password?
What is the minimum age to use Reflect?
Should you pick Reflect?
Reflect is a mature, opinionated product rather than a broad platform. Launched in 2021 and still shipping, with a changelog running into 2026, it has kept the same four commitments throughout: speed, security, reliability and deliberate simplicity. Those choices show up as much in what is absent as in what is present. There is no Windows client, no Android client, no team workspace and no tiered pricing, and the company says openly that it will not suit advanced or unusual workflows.
What it does offer is unusually well built. Client-side encryption audited by an outside firm, a published cryptography library, a genuine choice of AI model, an API, an MCP server and a command line add up to more control than most note apps grant. The no-questions refund policy and the export commitment point the same way.
The picture grew more complicated in July 2026. Reflect Open, a free MIT-licensed rewrite that keeps notes as plain Markdown on your own disk, now sits beside the subscription app the company continues to maintain. For a new user that is a real decision rather than a detail, since the two differ in platform coverage, feature completeness and security model: Reflect Open is still beta, has no web or iPad version, and leans on iCloud or Git instead of adding encryption of its own.
Before committing, note what the site does not publish: no data processing agreement, no Article 27 representative, no SOC 2 or ISO certification and no hosting country. Those gaps matter little for personal use and a great deal in a procurement review. As an individual tool for someone who writes daily on Apple hardware and cares about who can read what, Reflect remains a strong and unusually candid option.
- Choosing a selection results in a full page refresh.
- Opens in a new window.