Privacy

This describes what the software actually does. Every claim below is checkable against the source, and several of them are things most products cannot say. It is not legal advice, and it should be reviewed by a lawyer before anyone is charged money.

Operated by [ENTITY], [ADDRESS]. Questions, requests and complaints: [PRIVACY_EMAIL]. Governed by the law of [JURISDICTION].

What we collect

Your account. An email address, and optionally a name. A password if you set one — passwords are optional here, and stored only as a bcrypt hash. If you sign in with Google we receive your email address and name and nothing else; we do not ask for access to your Google account beyond identifying you.

What you write. Notes, checklists, annotations, folder names, templates, and the files you upload. This is the whole point of the product and it belongs to you.

How you use it. Sign-in times and the network address a sign-in came from, kept so that you and we can see whether somebody else has been in your account. Which workspace you were last in, so the app opens where you left off.

A time zone, reported once by your browser, so that a note dated "today" is dated the day you are actually having.

We do not collect anything else. There is no analytics package, no advertising network, and no third-party script of any kind on any page of this application.

Where it lives, and who else touches it

That is the complete list. Nobody else receives your data, and none of it is sold, rented or shared for advertising.

Some specifics worth stating

Your notes stay out of our logs. What you write — notes and their titles, checklist items, cards, annotations, comments, the names of folders and files — and what you search for are filtered out of application logs before anything is written down, whether you are in the browser or using the API. When something goes wrong on a page, what you wrote is not in the error report.

Uploaded files are private. They are stored in a bucket that is not public, and nothing is ever served from it directly. Every read goes through the application, which checks whether you are allowed to see it first.

Text recognition runs on our own machines. When we pull the text out of a scanned document or a photograph so you can search it, that happens on our infrastructure. No document of yours is sent to a third-party service to be read.

We do not read your notes. Nobody at [ENTITY] opens your content as a matter of course. The admin tools deliberately show counts, dates, sizes and states — never the words you wrote — and that boundary is asserted by our own tests.

Sign-in is rate limited, and passwords, tokens and sign-in codes are never stored in a form that can be read back.

How long we keep it

Your content stays until you delete it. Deleting a workspace deletes its notes, its checklists, and the files attached to them, including from the file store — not merely hidden from you.

Notifications — the record that somebody wrote your name or gave you a card — are deleted 30 days after you read them. Unread ones are kept until you read them, because something you have not looked at yet is not something to throw away. A notification stores what happened and where, never a copy of what was written: the words you see in your inbox are read from the note itself each time, so writing you can no longer open is writing your inbox stops showing.

Sign-in records — when you signed in, how, and from which address and browser — are kept for 24 months so that unusual activity can be noticed, and then deleted. A session ends after 30 days without use, and 90 days after you signed in however much you use it; after that you sign in again. Signing out ends it at once.

Delete your account from Your account → Delete your account, after exporting and transferring or deleting every workspace you own. This removes your profile, sign-in methods, sessions, API keys, OAuth connections, sign-in records, activity records and memberships. A placeholder author record remains for shared writing, comments and history, displayed as “Deleted account”. Content in shared workspaces stays there, including any personal details you wrote into it; remove those before closing your account. Administrative audit records are retained for security and may contain previous account details. Account deletion cannot be undone.

Getting your data out

Export is unconditional. Every workspace exports to a zip file — notes as Markdown, files as files — on every plan including the free one, at any time, without asking us. It works even while a workspace is frozen for being over its limit. This is not a feature we can withdraw as leverage; it is how the product works.

If you would rather we did it, or you want something we do not offer as an export, write to [PRIVACY_EMAIL].

Your rights

Depending on where you live, you may have the right to see the personal data we hold about you, to correct it, to have it deleted, to object to how we use it, and to complain to a regulator. Most of this you can do yourself from inside the app; for anything else, write to [PRIVACY_EMAIL] and we will answer within [RESPONSE_DAYS] days.

Our legal basis for handling your data is performing the contract you entered into by making an account, and our legitimate interest in keeping the service running and secure.

Cookies

One cookie, which keeps you signed in. See the cookie page.

Children

This is not intended for children under [MINIMUM_AGE], and we do not knowingly create accounts for them.

Changes

If this changes in a way that matters, we will say so by email before it takes effect rather than quietly editing the page. The date at the bottom is the date of the last edit, and it comes from the file's own history rather than from somebody remembering to update it.

Last updated September 20, 2026.