Privacy Notice

1. Who is responsible for your data

Notes is operated by Viktar Harbatau, individual activity, of Daugu g. 4B, Vilnius, LT-02119, Lithuania ("we", "us", or "our"). We are the controller of the personal data described in this notice. For privacy questions or requests, contact us at notes-app-support@googlegroups.com.

2. Personal data we process

• Display name and session identifier. You choose a display name to join a shared note. A random session identifier, display name, colour, cursor position, and last-seen time are processed to show presence and collaboration.
• Note content. Text, checklist items, and completion state that you or another participant enters into the shared note are stored so the workspace can be displayed and synchronised.
• Browser storage. Your browser stores your display name, theme preference, and a local draft in local storage; it stores a session identifier in session storage. You can remove this information through your browser settings.
• Technical information. Our hosting and security providers may process standard network and device information, such as IP address, request metadata, and security logs, to deliver and protect the service.

3. Why we use data and our legal bases

We use the data above to provide the shared workspace, keep it working, prevent abuse, and respond to support requests.

• Where GDPR applies, we process workspace and support data to provide the service you request and to take steps connected with that service.
• We process limited technical, security, and operational data for our legitimate interests in keeping Notes secure, reliable, and preventing misuse.
• If we need consent for a particular optional feature, we will ask for it at the relevant time. You may withdraw consent at any time without affecting earlier processing.

4. Who can see data

Notes currently provides one shared workspace. Every person who opens that workspace can see its note content and the display names and presence details of active participants. Do not put confidential or sensitive information in it.

We use service providers to host, secure, and operate Notes. They may process personal data only as needed to provide those services and subject to applicable contractual and legal safeguards. We do not sell personal information or share it for cross-context behavioural advertising.

5. International transfers

Hosting and security infrastructure may process data in countries other than where you live. Where European data-protection law applies and a transfer needs a safeguard, we use an approved transfer mechanism, such as the European Commission’s Standard Contractual Clauses, when applicable.

6. Retention

• Active session and cursor records are removed after approximately 16 seconds without a heartbeat from the browser.
• Shared note content remains until it is deleted from the workspace or removed when reasonably necessary for security, operations, or legal obligations.
• Browser-stored data remains on your device until you clear it or your browser removes it.
• Technical logs are retained only for the period needed for security, diagnostics, and legal compliance under the applicable provider’s retention settings.

7. Your privacy rights

Depending on where you live, you may have rights to request access to, correction of, deletion of, restriction of, or portability of your personal data, and to object to certain processing. To exercise a right, email notes-app-support@googlegroups.com. We may need information to verify your request and will respond within the time required by applicable law.

If GDPR applies, you can also complain to the data-protection authority in your habitual residence, workplace, or the place of the alleged infringement. For California residents, subject to applicable law, this includes the rights to know, delete, and correct personal information, and freedom from discrimination for exercising those rights. We do not sell or share personal information as those terms are defined by the California Consumer Privacy Act.

8. Children

Notes is not directed to children under 16, and we do not knowingly collect personal data from them. If you believe a child has provided personal data, contact us so we can take appropriate steps.

9. Security and changes

We use reasonable technical and organisational measures designed to protect the service. No system is completely secure, so please do not submit data that would cause you harm if exposed. We may update this notice as the service changes; the date above shows when it was last revised.