If you have signed up on dubious websites with questionable privacy policy, many of them legally sell this data to “data brokers” who then sell it to anyone willing to pay. This happens more than you’d think, for example in 2019 it was reported California DMV makes $50 million a year selling users information. https://www.caranddriver.com/features/a32035408/dmv-selling-driver-data/

One neat trick is to signup for services with an email like name+website@domain.com, that way if you ever get spam you’ll know where you have been compromised.

This was it, thank you so much!

After trying a bunch, I’m using Obsidian + <your choice of sync plugin> now. Good thing with Obsidian is your notes are ultimately a bunch of plaintext files, so you can do whatever you want with them, and it comes with clients for most platforms.

Another option is Trilium, it is pretty powerful, and has a webapp so as long as you can access a browser, you’ll be able to access your notes. https://github.com/zadam/trilium