Privacy Policy

End-to-End Encryption

Your notes are end-to-end encrypted. This means your notes are encrypted on your device before being sent to our servers. We store encrypted notes but we cannot decrypt or read them. Only you can decrypt and access your notes. We do not have access to the encryption keys needed to decrypt your notes.

Purpose of Data Collection

For every type of data Notezz collects from you, the purpose is stated below:

Data collected: Account data (username, email address, password — stored as a salted hash, never in plain text), collected when you register.
Purpose: to create your account and authenticate you when you log in.
Data collected: Facebook Login email address (optional; Facebook Login is being retired on 14 Sep 2026) — if you choose to sign in with Facebook, we request only your email address and no other Facebook data.
Purpose: to create or authenticate your Notezz account.
Data collected: a single-use one-time login token, emailed to you via our email provider (Mailgun) when you request a passwordless login link.
Purpose: to verify it's you and log you in.
Data collected: your notes' content, encrypted on your device before it ever reaches us — we store only the resulting ciphertext.
Purpose: to save and sync your notes across your sessions. We cannot read this content.
Data collected: technical/security logs (IP address, request timestamps), collected automatically and kept only briefly.
Purpose: to rate-limit login attempts and note requests and to detect abuse (e.g. brute-force login attempts).
Data collected: your session token, and — only while your session is unlocked — your decryption key, held in your browser's local/session storage on your own device (not cookies).
Purpose: to keep you logged in and let you decrypt your own notes without re-entering your password for every action. We do not use cookies, and we do not use any third-party analytics, advertising, or tracking technologies.

Sharing your data

Service providers: we use Mailgun to deliver transactional emails (one-time login links, account notices) and Fly.io / Netlify to host our backend and frontend. These providers process data only as necessary to run the service on our behalf. Note: we cannot share the content of your notes with anyone as they are end-to-end encrypted and we cannot read them.
For business transfers: We may share or transfer your personal information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company. Your encrypted notes would remain encrypted and unreadable.
For legal requirements: Under certain circumstances, we may be required to disclose your personal data if required to do so by law or in response to valid requests by public authorities (e.g. a court or a government agency). However, your notes are end-to-end encrypted and we cannot provide the decrypted content of your notes to anyone.

Security of Your Personal Data

The security of your personal data is important to us. Your notes are protected using end-to-end encryption, meaning they are encrypted on your device before transmission and we cannot read them. However, remember that no method of transmission over the Internet, or method of electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your personal data, we cannot guarantee its absolute security.

Important: You are responsible for keeping your password secure. If you lose your password, we cannot recover your encrypted notes as we do not have access to your encryption keys.

Privacy Policy

End-to-End Encryption

Purpose of Data Collection

Sharing your data

Security of Your Personal Data

Deletion of Your Personal Data

Changes to This Privacy Policy

Contact Us