Privacy
What this service stores and what it cannot read
This page describes the data handling in plain language. It covers encrypted notes, paste links, image tools, account records, and the choices you have before and after signing up.
Encryption
Notes and shared content are encrypted in the browser with the Web Crypto API using AES-GCM. A vault key is generated on your device during setup, and the recovery secret you keep wraps that key. The server stores the wrapped key and the sealed payloads; it never receives the unwrapped key.
What the server can see
- Account email, display name, and sign-in method
- Timestamps, record identifiers, and payload sizes
- Share expiry, view counts, and revocation state
- Standard request logs such as IP address and user agent
What the server cannot see
- Note titles, body text, labels, or checklist items
- Paste contents, one-time secrets, or shared images
- Any recovery secret, vault key, or share fragment key
- Images processed with the local image tools
Keys never travel
Share links carry their decryption key after the # symbol. Browsers do not transmit that part
of a URL, so the key stays on the devices you send the link to. Signing in with Google or GitHub
authenticates you; it is never used as an encryption key.
Your data and export
Notes, pastes, and shared images belong to your account and are listed in the settings area as soon as they are created. Signing out does not delete anything.
Export
Requesting an export produces an archive of your account data. You can download it at any time from the settings page, and you do not need to contact support first.
Deletion
Deleting the account removes the stored payloads, the wrapped vault key, and the account record. Deletion is not reversible, and any note you did not export first cannot be reconstructed.
Sessions
Active sessions are listed with their device label and last-seen time, and each one can be signed out individually. Changing a password or a linked sign-in method invalidates the other sessions.
Cookies and tracking
A single session cookie keeps you signed in. It is set with the HttpOnly,
SameSite, and Secure attributes in production. There are no advertising cookies,
no third-party analytics scripts, and no behavioural profiling.
Images and media
The image tools run entirely in the browser. Images leave your device only when you deliberately create a private share link, and that link holds an encrypted copy rather than a public URL.
Report abuse
Share links are private by design, but an encrypted link can still be sent to someone who does not want it. If a paste or shared image is being used to harass or impersonate, report it.
- Include the share link so the record can be located
- Describe what was sent and when it arrived
- Reports are reviewed by hand rather than by an automated filter
Can you reset my password and unlock my notes?
A password reset restores access to the account, not to the notes. Decrypting them needs the vault recovery secret, which the service never receives.
Do you sell or share data with advertisers?
No. There is no advertising on the site and no data broker relationship. Account records exist to run the service you asked for.
How long are share links kept?
A share stops resolving when it expires, when its view limit is reached, when it is burned after reading, or when the owner revokes it. Expired records are removed on a schedule.
Are private pages indexed by search engines?
No. Account pages, share pages, the installer, and the admin area all send
noindex, nofollow, and none of them appear in the sitemap.