Privacy
What this service stores and what it cannot read
This page describes the data handling in plain language. It covers Notes, Vault, paste links, image tools, account records, and the choices you have before and after signing up.
Ordinary Notes
Notes works after sign-in without a recovery secret. Note text, labels, checklist items, reminders, and attached images reach our server over HTTPS and are encrypted at rest with a server-managed key. The service can technically decrypt ordinary notes to return them to your signed-in browser. Ordinary Notes is not end-to-end encrypted. There is no admin feature for browsing note contents. Moving a note to Vault removes the current ordinary-note copy, but it cannot erase earlier copies from hosting backups.
Optional Vault and private shares
Vault notes and shared content are encrypted in the browser with the Web Crypto API using AES-GCM. A vault key is generated on your device during setup, and the recovery secret you keep wraps that key. The server stores the wrapped key and the sealed payloads; it never receives the unwrapped key. Save the recovery kit somewhere safe. If you lose the secret and have no unlocked device, we cannot restore your Vault.
What the server can see
- Account email, display name, and sign-in method
- Timestamps, record identifiers, and payload sizes
- Ordinary-note contents when serving your account, plus pin, archive, and trash state
- Share expiry, view counts, and revocation state
- Standard request logs such as IP address and user agent
What the server cannot see
- Vault note titles, body text, labels, checklist items, or images
- Paste contents, one-time secrets, or shared images
- Any recovery secret, vault key, or share fragment key
- Images processed with the local image tools
Keys never travel
Share links carry their decryption key after the # symbol. Browsers do not transmit that part
of a URL, so the key stays on the devices you send the link to. Signing in with Google or GitHub
authenticates you; it is never used as an encryption key.
Your data and export
Notes, pastes, and shared images belong to your account and are listed in the settings area as soon as they are created. Signing out does not delete anything.
Export
Requesting an export produces an archive of your account data. You can download it at any time from the settings page. Ordinary notes are readable in this archive, so store it privately. Vault notes and shared content remain encrypted; Vault needs its recovery secret, and shares need their original full links.
Deletion
Deleting the account removes the stored payloads, the wrapped vault key, and the account record. Deletion is not reversible, and any note you did not export first cannot be reconstructed.
Sessions
Active sessions are listed with their device label and last-seen time, and each one can be signed out individually. Changing a password or a linked sign-in method invalidates the other sessions.
Cookies and tracking
A single session cookie keeps you signed in. It is set with the HttpOnly,
SameSite, and Secure attributes in production. There are no advertising cookies,
no third-party analytics scripts, and no behavioural profiling.
Images and media
The image tools run entirely in the browser. Images leave your device only when you deliberately create a private share link, and that link holds an encrypted copy rather than a public URL. Images attached to ordinary Notes are uploaded and use the same server-managed encryption as the note.
Report abuse
Share links are private by design, but an encrypted link can still be sent to someone who does not want it. If a paste or shared image is being used to harass or impersonate, report it.
- Include the share link so the record can be located
- Describe what was sent and when it arrived
- Reports are reviewed by hand rather than by an automated filter
Can you reset my password and unlock my notes?
A password reset restores account access, including ordinary Notes. It cannot unlock Vault: that needs your recovery secret, which the service never receives.
Do you sell or share data with advertisers?
No. There is no advertising on the site and no data broker relationship. Account records exist to run the service you asked for.
How long are share links kept?
A share stops resolving when it expires, when its view limit is reached, or when the owner revokes it. Views are counted when encrypted content is retrieved, including for single-use links; successful decryption is not required. Becoming unavailable is separate from removal of stored records and hosting backups.
Are private pages indexed by search engines?
No. Account pages, share pages, the installer, and the admin area all send
noindex, nofollow, and none of them appear in the sitemap.