Privacy Policy

Last updated: 25 October 2026

This policy explains what RealNotes (“the app”, “we”) collects, why, who else handles it, and what control you have. The short version: we store your notes encrypted, we don’t sell your notes, and we reserve the right to show relevant ads on the free plan (see section 3).

To reach us, use the Contact us form.

1. What we collect

Account data

• Email address, display name, and a unique handle you choose.
• Your password, which is handled by our authentication provider (Supabase) and never stored by us in readable form.
• Plan, quota usage (note count, bytes used), last-login time, and whether you have asked to delete your account.

Content you create

• Notes, folders, tags, wikilinks between notes, @mentions, and daily-note dates.
• Attachments you upload to us, plus their filename, type, size, and hash.
• Your settings and preferences.

Sharing data

• Who you share a note with (a user, or an email address if they have no account yet) and when.
• Notifications about shares and mentions.

Messages you send us

• If you use the Contact us form: your name, email address, topic, and message. Our administrators can read these.

Technical and security data

• An audit log of certain account actions (what happened and when).
• Counts of failed attempts to share with a nonexistent handle, used to prevent abuse.
• Basic, aggregated usage and performance data from Vercel Analytics when you use the website.
• Session cookies that keep you signed in.

2. How your content is protected

• Note bodies and attachments stored on our servers are encrypted with AES-256-GCM, using a separate key for each user. Those keys are themselves encrypted with a master key held by us.
• What this means: your content is encrypted at rest, and other users cannot read it without your permission. Because we hold the master key so that the app can work for you, encryption does not make the content unreadable to us as the operator. We access note content only if needed to operate the service, investigate abuse or a security incident, or comply with law.
• Not encrypted: note titles, folder names, tags, tag relations (such as the label and tags in a line like works_at:: #acme), and link titles are stored in plain text so that search and the graph view work. Don’t put sensitive information in titles, tags, or relation labels.
• Attachments you keep in your own cloud storage (section 4) are encrypted in your browser before upload. The Google Drive refresh token we hold for that feature is encrypted with the master key. We store it, and the app can use it to reach your Drive, but only for the files and folder the app itself created.

3. How we use your data

• To provide the app: store, sync, search, share, export, and import your notes.
• To send emails you trigger, such as a share invitation.
• To enforce plan limits and keep the service secure and free of abuse.
• To understand overall usage and fix problems.
• To respond to messages you send us.

Advertising. We reserve the right to show ads in the app, including ads that are relevant to you based on information about you and your use of the app. Our advertising partners may use cookies or similar technologies for this, where you have permitted it or the law allows. We do not sell your personal data, and we do not use your notes to train AI models.

4. Optional: attachments in your own cloud storage

You can choose to keep attachments in your own Google Drive:

• You approve access once in a Google pop-up. The app requests only the narrow permission needed to see and manage the files and folder it creates, not the rest of your storage.
• So that uploads and downloads keep working across your devices without asking you to sign in again, our servers store a Google refresh token, encrypted with our master key, and use it only to obtain short-lived access tokens for your Drive on your behalf. We never see your Google password. We delete the token when you disconnect storage or delete your account, and we ask Google to revoke it at the same time. You can also revoke access at any time in your Google account.
• Apart from that token, our servers store only metadata: whether Google Drive is linked, the account email (to show in Settings), the app’s folder ID, and each file’s ID, size, and hash.
• Files are encrypted in your browser before upload. While a note is shared, its encrypted attachments are made readable by link so recipients can fetch them. Recipients receive the decryption key only while they have access to the note.

The app’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can disconnect storage at any time in Settings, and revoke access in your Google account.

5. Who else handles your data

Where your data is stored. Our database is currently hosted on Supabase in the AWS Asia Pacific (Tokyo, Japan) region. We reserve the right to store and process data in other locations, including other countries, as our providers or needs change. These providers process data on our behalf and under their own terms and privacy policies. We may disclose data if required by law.

6. Sharing with other people

Notes are private unless you share them. When you share a note, the people you choose can view it (and its attachments) until you revoke access. Revoking does not remove copies someone has already viewed, downloaded, or cached. Mentioning @handle shares the note with that user, and they can see your display name and handle. Invitations to an email address with no account are held until that person signs up.

7. Local storage on your device

The app stores a cache of notes and pending attachment uploads in your browser (IndexedDB, local and session storage) so it can work offline and resume uploads. We use cookies for sign-in sessions and, if ads are shown, our advertising partners may set their own.

8. How long we keep data

• Your data is kept while your account is active.
• Trash: deleted notes stay in Trash, and count toward your storage, for 30 days. After that they are deleted automatically, or sooner if you delete them permanently yourself.
• Account deletion: you can delete your account in Settings. We then wait 30 days, during which you can cancel, and afterwards permanently delete your account, notes, and attachments stored with us. Copies in our backups are overwritten as backups rotate. We may keep limited records, such as an anonymised audit log, where needed for security or to meet legal obligations.
• Files in your own Google Drive stay there until you delete them. The stored Google refresh token is deleted when you disconnect storage, delete your account, or Google reports that access was revoked.
• Contact messages are kept as long as needed to deal with them.

9. Your choices and rights

You can export all your notes from the app at any time, correct your profile in Settings, delete notes, disconnect your cloud storage, and delete your account. Depending on where you live (for example the EU/UK under GDPR, or California under the CCPA), you may also have the right to access, correct, delete, restrict, or port your data, to object to processing, and to complain to your data-protection authority. To exercise these rights, use the Contact us form.

10. Children

The app is not intended for children under 13. We do not knowingly collect their data. If you believe a child has signed up, tell us through the Contact us form and include proof, such as evidence of the child’s age and of your relationship to them. We will act on a report once we have that proof, which may include deleting the account.

11. International transfers

Our providers may process data in countries other than yours. Where required, we rely on appropriate safeguards such as standard contractual clauses.

12. Security

Besides encryption, we use access controls enforced in the service layer and database row-level security, and we rate-limit abusive actions. No system is perfectly secure. We will notify you and the relevant authorities of a breach as required by law.

13. Changes

We may update this policy. For material changes we will notify you in the app or by email before they take effect. The date at the top shows the latest version.

14. Contact

Use the Contact us form. [Add a postal address here if your jurisdiction requires one.]