Changelog

Added

• Ruby and Python get command-line tools. gem install freshjots and pip install freshjots now install a freshjots command-line tool alongside the importable client library — the same command surface as the npm and Homebrew CLIs (create, append, ls, rm, mv, folders, encrypt, and the rest), with the same one-line confirmations and -q/--quiet flag. Every install path — npm, Homebrew, RubyGems, PyPI — now gives you the same freshjots command.
• Command-line clients confirm every action. The freshjots CLIs (npm and Homebrew) now print a one-line confirmation for every write — created #12 deploy-log, deleted #12, moved #12 -> folder 3 — so a script or a person always sees what happened; add -q / --quiet to silence them for log-streaming loops. The npm CLI also now accepts a note body positionally (freshjots create "Title" "body"), matching the docs and the other clients.
• Web clipper. A one-click bookmarklet saves the page you're reading — its title, URL, and any text you've selected — straight into a Fresh Jots note, with no extension to install. Drag it to your bookmarks bar once; clicking it opens a prefilled note for you to review and save. Setup and the bookmarklet live at /web-clipper.
• Install Fresh Jots as an app. Fresh Jots is a Progressive Web App — install it to your phone's home screen or desktop and it runs in its own standalone window, with a "Quick note" shortcut and a share target so you can send text or a link straight from another app's share sheet into a new note at /quick.
• Tamper-evident notarization — every note, every plan. Every note is cryptographically notarized, free tier included, no card: its content is hashed — an append-only log entry by entry as each arrives, a note you edit snapshotted once a day — and every account's new hashes are folded into a daily Merkle tree whose root is anchored to the Bitcoin blockchain via OpenTimestamps, a permanent public timestamp neither you nor we can alter afterward. Background at /notarized-notes.
• RFC 3161 trusted timestamps. Alongside the daily Bitcoin anchor, content that lands as it is written — an append-only log entry, a captured AI-session note — is independently timestamped the instant it arrives by an RFC 3161 timestamping authority, so it carries verifiable proof of existence immediately rather than waiting on the daily anchor to confirm.
• One-page proof verifier at /verify — upload or paste a note's proof (and, optionally, your own copy of the note) and get a plain-language verdict in the browser. Any signed-in user, any plan; nothing you submit is stored. The command-line walkthrough lives at /notarization.
• Provenance dashboard + one-click proof downloads. /settings/provenance lists your notarized notes with each note's tamper-evidence status, filtering, sorting, a trusted-timestamp filter, note title and linked machine name, and an in-browser verifier — plus one-click download of any note's proof bundle. On the Dev and Team plans, with a 14-day trial of the full Dev surface.
• Verifiable proof bundled with every export. The full-account export now includes a self-verifiable proof.json alongside each note, and a single note's .txt download comes paired with its proof — so you, or anyone you hand it to, can verify a note offline against Bitcoin, trusting no one, us included.
• Client-encrypted notes — store what we can't read. Encrypt a note's body on your own machine and send the ciphertext with client_encrypted: true (via the API or MCP). Fresh Jots stores and returns the ciphertext byte-for-byte, never sees your key, and cannot decrypt, search, or recover it — nor can anyone who compels or breaches us. The web editor is read-only for these notes (change them through the API); dead-man and append alerts still fire on silence, and the note can still be notarized. Personal plans only, including Free. Details at /encrypted-notes.
• Find & Replace and Undo / Redo in the note editor. The plain-text editor gains Find & Replace and full Undo / Redo, and now shows the note's API / CLI id in its metadata strip so you can address the same note from a script.
• Browser-extension capture token. Any active subscriber (Personal included) can mint a single-note, append-only capture token from /settings/extension_token for a clip utility or browser extension — separate from the Dev-tier API tokens, so a grab-and-append helper never carries your full API surface.
• Free read-only MCP access. Non-Dev users can connect an AI client to Fresh Jots over MCP (OAuth 2.1) with free, read-only access — read and list your notes from Claude and other MCP clients without a Dev subscription. Writes still require the Dev or Team API tier.
• Live-updating dashboards and lists. Creating, renaming, deleting, restoring, or moving a note or folder now updates your home dashboard, folder lists, and notes list in real time over Turbo Streams — including changes made in another tab or, on a team, by a teammate.
• Send a test webhook. Any note with an outbound webhook gets a one-click test delivery that sends a signed sample payload, so you can confirm your endpoint and signature check before wiring up real events.
• Chat-platform webhook formats. An outbound note webhook can post straight into Slack, Discord, Google Chat, Mattermost, or Rocket.Chat — pick the format per note and the payload is reshaped to that platform's incoming-webhook schema instead of the default signed note.appended JSON envelope. Chat formats carry no HMAC signature, since those receivers can't verify one, so the unguessable hook URL is the credential.
• Append-only notes explainer at /append-only-notes — what log-stream notes are, how inbound-webhook and API appends work, and when to reach for one.
• "Dev" tier renamed. The middle paid plan is now called Dev (it was "Pro") — same $149/year price and the same features, just a clearer name for the developer / API tier.
• Team tier (NEW) — $179/seat/year. Multi-seat workspace with shared notes, shared folders, owner / admin / member roles, dead-man alerts with one-click ack, per-team API tokens, and a 90-day audit log. 2-seat minimum, up to 25 seats. Manage from /team after subscribing.
• Team notes at /team/notes — every team feature from the personal side: full CRUD, search/sort/filter, soft-delete + undo, public share links, append-only locking, revisions, bulk delete. Notes carry the writer's user id for audit and the workspace id for visibility.
• Team folders at /team/folders — workspace-shared folder containers (100/team max). A personal "Q4" folder and a team "Q4" coexist freely; the API scope-validates folder ids so a team token can never park a team note in a personal folder.
• Team API tokens at /team/api_tokens — owner/admin-only bearer tokens that hit the team's pool, not the actor's personal pool. Same /api/v1/* surface, same wire format; bulk endpoint enabled on every team token. 30 active tokens per team.
• Team dead-man alerts + one-click ack. Overdue append-only team notes email every accepted member; the first ack mutes the alert team-wide for 4 hours so the same outage doesn't page everyone repeatedly. Ack works from any phone/tab without sign-in (signed token, 24h TTL).
• Team audit log at /team/audit_events — owner/admin-only. Every workspace write recorded with who/what/when, 90-day retention.
• Team note comments + @mentions. Team notes carry threaded comments with @name mention autocomplete over the workspace roster. Comments are immutable once posted; the author or a team owner/admin can delete and undo them.
• In-app notifications. A notification bell surfaces when you're @mentioned or someone replies on a team note, with mark-as-read and per-user preferences (mute mentions or replies) under /settings.
• Live presence and edit-conflict guard on team notes. See who else is viewing a team note in real time, with autosave and a guard that stops one member's save from silently overwriting a teammate's concurrent edit.
• Read-only "viewer" team role. A fourth role beside owner / admin / member: a viewer reads and exports team notes and folders but can't write or mint API tokens — enforced in the browser, the API, and MCP.
• Team ownership succession & transfer. An owner can name a successor (ownership auto-transfers if the owner's account goes inactive) or hand ownership over manually, and an over-seated banner warns when accepted members exceed the paid seat count.
• Public per-note share links. Toggle Share on any note to mint a public, read-only URL — anyone with the link can read; toggle off to revoke instantly. Pages set noindex so search engines won't list them.
• Service limits page at /limits — single canonical reference for every cap and rate limit, pulled live from running configuration.
• End-User License Agreement at /eula.
• Per-user API error log at /settings/api_errors — every 4xx your bearer-token requests received, newest first.
• Idempotency-Key header on API write endpoints — opt-in, 24h dedup window per user, stable error code on conflict.
• Durable inbound webhook buffer. POST /h/:token now persists every accepted delivery to the database before formatting, so a Rails restart, hot-note contention, or a transient database blip no longer drops in-flight events. Failed deliveries surface on /settings/monitoring as a dead-letter panel with one-click Replay and Delete. Senders get back a 200 OK with an X-Ingestion-Id response header so a curl -i on the sender side correlates to the buffer row on this side. Dev / Team only — same tier gate as inbound-inbox tokens.
• Free-tier usage meter on the dashboard and notes list.
• Welcome note auto-created on first signup; welcome email sent on first confirmation.
• Folder view pagination (30 notes per page).
• SEO metadata: per-page descriptions, Open Graph / Twitter cards, canonical URLs, branded titles.
• Sign-up rate limit (5/hour/IP) and per-email login throttle (5/20 min) in Rack::Attack.
• Honeypot field on the sign-up form.
• API tier (Dev and Team plans) — bearer-token REST API at /api/v1, with notes and folders resources, atomic append, bulk creates, append-by-filename addressing, and /settings/api_tokens for token management.
• 14-day API trial token on signup (code mode). Picking the developer onboarding mode mints a free mn_… bearer token usable against /api/v1/* for 14 days, with no plan attached. Plaintext is shown once on the post-onboarding flash and emailed alongside a one-line curl example; a Trial badge marks the row on /settings/api_tokens until it expires. Expired trial rows are swept daily; non-trial tokens are never swept.
• Pricing redesigned to four tiers: Free, Personal ($24/yr), Dev ($149/yr or $15/mo), Team ($179/seat/yr).
• Lapsed paid users transition to read-only — every existing note remains readable + exportable for up to 12 months after the last payment.
• Plan-change flow with downgrade gates — switching to a lower tier surfaces a per-cap blocker list.
• Public API docs at /docs.
• Sign in with Google or GitHub. Create an account or sign in with a Google or GitHub identity alongside the usual email and password; when two-factor is on, an OAuth sign-in passes through the same one-time-code challenge.
• Two-factor authentication. Turn on TOTP two-factor from /settings/security — scan the QR code into any authenticator app, confirm a code, and save 10 one-time recovery codes. A sign-in challenge and a step-up re-authentication on sensitive account changes follow automatically.
• Sign out other devices. One button on /settings/security ends every other browser and device signed in to your account while keeping the current session, so a lost or shared device can be cut off instantly.
• Outbound webhooks and dead-man's-switch alerts. On the Dev and Team plans, give an append-only note an outbound webhook URL and every accepted append POSTs a signed JSON payload (HMAC-SHA256 in the X-FreshJots-Signature header); a persistently failing endpoint is disabled automatically so it can't drain the queue. Set a dead-man deadline on the same note and Fresh Jots emails you — or a chosen alert address — when it goes silent past the deadline, resetting the moment the next append lands. Background at /dead-mans-switch.
• Import from other notes apps. Options → Import takes an upload of Markdown, HTML, plain-text, RTF, Word (.docx), OpenDocument (.odt), or Evernote (.enex) files — or a .zip of them, whose nested folders become folders — and turns each file into a note. Large archives are parsed in the background.
• Note revision history. Each note keeps a running history of earlier versions; open History to review them and restore any earlier revision in place.
• Download a note as PDF or Word. Any note exports to a formatted PDF or a Word .docx, alongside the existing plain-text .txt download.
• Pinned notes. Pin the notes you reach for most and they surface in a dedicated Pinned strip at the top of your dashboard.
• Trash with 30-day restore. Deleting a note moves it to /trash rather than erasing it — an Undo link appears right after deletion, and the note stays restorable there for 30 days before it's purged for good.
• Public status page at /status — a live snapshot of service health plus a running incident log, readable without signing in.
• bin/backup — Postgres dump runner with retention pruning and optional rsync/S3 off-host copy.
• Sentry error tracking (no-op unless SENTRY_DSN is set).

Changed

• More depth on buttons. Primary buttons and calls to action now carry a subtle gradient and soft shadow for a bit more depth.
• Dev tier now billable monthly. The Dev tier can be paid $15/month as well as $149/year (annual works out to roughly two months free). Personal and Team stay annual-only; switch billing interval from the billing portal.
• Append-only notes are deletable. A locked (append-only) note now deletes, soft-delete-undoes, and purges exactly like any other note — the lock governs how it's written, not whether it can be removed.
• Note hashid in the API. API note responses now include each note's signed hashid alongside the integer id, and note endpoints accept that hashid — the same identifier used in web URLs and over MCP.
• Full-account export is now async, delivered by email. Options → Download all enqueues a background job, builds the archive off-request, and emails a one-time signed download link valid for 24 hours.
• API token expiry policy. Tokens default to 90-day expiry; user-set expiries beyond 1 year are rejected.
• Notes list Latest sort now orders by updated_at (most recently edited) rather than created_at.
• Dev per-note plain-text limit raised from 1.5 MB to 3 MB, matching the Team tier. Free and Personal stay at 1 MB. No migration — existing notes are unaffected; Dev scripts can now POST larger single payloads in one request.

Fixed

• Live updates now survive moving around the app. Real-time updates could quietly stop after you navigated within a session — for example, opening a note and then returning to your dashboard. A note created or deleted elsewhere (from a script, the API, another tab, or a teammate) would no longer appear or disappear on its own until you reloaded the page. Your home dashboard, notes lists, folder views, append-only note bodies, the notification bell, and — on a team — live note comments and presence now keep their real-time connection across in-app navigation, so they update live without a refresh.

Security

• Obfuscated note URLs. Web note URLs now use a signed, non-sequential hashid (e.g. /notes/aB3xY…) instead of the raw database id, so note ids can't be guessed or enumerated from a URL.
• Webhook signing secrets encrypted at rest. Per-note outbound-webhook signing secrets are now stored with application-level encryption, and legacy unencrypted-read support was dropped.
• Hardened MCP endpoint. The /mcp OAuth surface gained tiered rate limits, RFC 8707 resource binding (access tokens are bound to this server as their audience), and paged resource listing.
• Tighter auth gates and data hygiene. Two-factor and PKCE/OAuth gates were tightened, and a sweep purges orphaned ActionText (rich-text) rows so a deleted note body leaves nothing behind.
• Visibility enforced on the API and MCP. The read-only viewer role is enforced on the REST API and MCP, MCP resources are narrowed to what the caller may see, and per-token note scoping was hardened.
• Email-change abuse window tightened. Devise's email-change endpoint is capped at 3/day per account and 3/day per target address.
• Tighter throttles on expensive surfaces. Note writes 120 → 30/min/user; per-note PDF/DOCX/TXT downloads 60 → 10/min; billing portal/change-plan 30 → 5/min; full-account export request 5 → 2/hour.
• api_errors log scoping. The per-user error log is read through current_user.api_errors only — wrong-owner lookups return nothing rather than leaking another user's request paths.

Removed

• Legacy flat monthly subscription plan — the paid lineup moved to the annual Personal, Dev, and Team tiers. (The Dev tier has since re-introduced a monthly option — see Changed above.)
• 30-day trial infrastructure — the freemium 10-note cap replaced it.