Privacy

Who we are

Notelet is made and run by Kristiyan Kanchev, an independent developer in the United Kingdom (“we”, “us”), who is responsible for your information under UK data protection law. Write to hello@noteletapp.com about anything on this page.

Using the app without an account

Your notes, reminders and attachments are kept on the device you write them on. We don’t receive them, or anything about how you use the app.

Syncing through your own storage

If you sync through storage of your own (an S3-compatible bucket, a WebDAV server or a folder), your devices send encrypted files straight to it. They never pass through us. That provider’s own terms and privacy policy apply to what it stores.

Checking for updates

The desktop apps, and the Android app installed from our website, ask downloads.noteletapp.com now and then whether there’s a newer version. Like any request on the internet, it carries your IP address and the app’s version. We use it only to answer that question, and to add one to a count of the day’s update checks.

What the app asks your device for

• Photos and camera: to add pictures to a note, and to scan the code that adds a device to your library.
• Notifications: for your reminders. They’re scheduled on the device itself.
• Face ID, Touch ID, Windows Hello or your fingerprint: to open locked notes. Your system checks it and tells the app only “yes” or “no”. We never see biometric data.
• Microphone (desktop only): to record audio into a note, when you ask it to.

What these produce stays in your notes, on your devices, and syncs encrypted like everything else.

Notelet Cloud

If you make an account, we keep:

• Your account: your email address, and your password stored as a one-way hash that can’t be turned back into the password. If you sign in with Google or Apple, we keep the account ID, name and email they share with us, and their sign-in tokens, encrypted.
• Your sign-ins: which devices are signed in, when they signed in, and the IP address and device type they did it from, so you can see and sign out your devices on the account page.
• Your library: the encrypted files your devices send, their sizes and when they changed. The files’ contents, including your notes’ titles and your attachments’ names, are sealed with a key made from your passphrase, which never leaves your devices. Their names on our side are technical ones that say nothing about your notes.
• Your plan: your storage used and allowed, a founder’s place or promo code if you have one, and your plan and subscription from Stripe.
• Abuse protection: for a short while, IP addresses and email addresses, to limit how often anyone can try to sign in or have emails sent.

We use this to run your account and sync your devices (that’s our contract with you), to keep the service secure and stop abuse (our legitimate interest), and to keep the records the law asks of us.

We email you only about your account: confirming your address, resetting your password, confirming you want to delete it, and important changes to the service or these terms.

Payments

Paid plans are bought on our website through Stripe, which handles your card details. We never see your full card number. Stripe tells us that you paid, for which plan, and when it renews or ends. The apps don’t sell anything.

Who helps us

A few companies process information for us, only to provide Notelet:

• Cloudflare hosts the website, the downloads and Notelet Cloud: its servers, its database and the encrypted files.
• Stripe takes payments.
• Resend sends our emails.
• Google and Apple, only if you choose to sign in with them.

Some of them may handle information outside the UK, in places such as the United States. When they do, it’s protected by the safeguards UK law requires, such as the UK’s International Data Transfer Addendum.

We don’t sell information about you, share it for advertising, or give it to anyone else unless the law requires it. Even then we could only hand over encrypted files we can’t open.

How long we keep it

• Your account information and files, for as long as you have the account.
• A file your devices delete or replace stays on our side for up to 30 days, so a mistaken or malicious deletion can be undone, then it goes.
• When you delete your account, your synced files and your email address are kept for 14 days, so we can bring the account back if you write to us that it was a mistake. Then they’re deleted. Our database backups roll over within 30 days.
• If you had a founder’s place, we keep your email address with a note that its place was used, so the same mailbox can’t claim a second one.
• Logs of the emails we’ve sent are kept for two days.
• Stripe keeps payment records for as long as tax law requires, and Resend keeps its own sending records, under their own policies.

Deleting your account

Delete it in the app (Settings, then Notelet Cloud) or on your account page. We email you to confirm first. Deleting it also ends a paid plan. Your notes stay on your own devices, and you can export them as PDFs, Markdown or plain text at any time.

Your rights

You can ask us for a copy of the information we hold about you, or to correct it, delete it or stop using it. You can also object to how we use it, or ask for it in a form you can take elsewhere. Write to hello@noteletapp.com and we’ll answer within a month. If you’re not happy with our answer, you can complain to the Information Commissioner’s Office at ico.org.uk.

This website

This website has no ads, no cookies, no tracking scripts and nothing loaded from anyone else. Its fonts and pictures come from our own server. The account pages use a single cookie, to keep you signed in.

To know how many people visit and download Notelet, our server adds one to a daily count for each page someone opens and each download: which page or file, and for a visit, the country, whether it’s a phone or a computer, and the website that linked to us. It keeps only those daily totals: no IP address, and nothing that could tell one visitor from another.

Children

Notelet Cloud accounts are for people aged 13 and over. If you believe a child under 13 has made one, write to us and we’ll delete it.

Changes

If this policy changes, we’ll update it here and change the date at the top. If a change matters, we’ll email Notelet Cloud accounts before it takes effect.