Indeed the hash isn’t passed. Privacy is saved 😅

One thing I did as well is to encrypt (server side) the note id before returning it to the browser. That way the actual db is obfuscated and can’t be guessed.