Privacy Policy

1. Who is responsible for your data

The controller of the personal data processed through MyNout is Jakub Šaroun, Business ID (IČO): 03858685, place of business Malý Šenov 6, 407 77 Velký Šenov, Czechia. Contact: info [at] mynout [dot] com.

Write to that address with any question about how your data is handled.

2. What data we process

Only what the service needs in order to work, by situation:

• Your account: your e-mail address, name, your password as a salted hash (scrypt — never readable), the language you chose, and a profile picture if you upload one. With Google sign-in, also the e-mail address, name, Google account ID and profile picture that Google provides.
• What you write: your notes (titles and content), their version history and trash, folders, tags and colours, the pictures you upload, and the people and links you share with. A password you put on a note or on a share link is stored only as a hash.
• End-to-end encrypted notes: if you turn encryption on, we store the title, content and history of an encrypted note only as ciphertext that we cannot open, together with your key sealed under your passphrase and under your recovery code. We never receive the passphrase or the recovery code. The folder, tags, colour, dates and size of a note remain readable to us.
• Security: for each signed-in session, the device (how your browser identifies itself), the network address it signed in from and the one it uses now, and when it was last active — you can review and end your sessions in the account settings. To protect against abuse we also record the network address and the browser an account was created from, and the country your browser names in its language setting (for example “en-GB” → United Kingdom; this is not a location lookup). A two-factor secret is stored encrypted, backup codes only as hashes.
• Problem reports: if you send one, what you write, the screenshot you choose to attach (it can show your notes), the address of the page within the app, your browser, window size, language and time zone, the app version and recent error messages from that page. The dialog shows all of it before you send.
• E-mails: we send the e-mails your account needs (confirming your address, resetting your password, changing your e-mail) and notices about sharing. If you e-mail a share link to someone, their address is used only to send that message.
• Language statistics: to decide which languages to add, we count visits per day by the language (and region) the browser asks for. These counts contain no address and no identifier.

Writing without an account: if you write without an account, we do not know your e-mail address or your name. The server stores the notes you write, a technical profile identifier, when the profile was created and last used by you, and any share links you create. These notes are stored in readable form, not encrypted in your browser — writing without an account is therefore neither anonymous nor end-to-end encrypted, and the administrator can technically reach the content (see “Who can see your data”). To protect against abuse, the profile also records the network address it was created from, your browser’s language and how your browser identifies itself, plus a keyed digest (HMAC) of the address that recognises several profiles from one network. Only the administrator can see these details; they are used for nothing but handling abuse and are deleted together with the profile.

We do not collect payment details, precise location, phone numbers or any special categories of personal data.

3. Who can see your data

You, and the people you share a note or a folder with. Notes that are not encrypted end-to-end are stored on the server in readable form; they are protected by your account, access controls and, if you use one, the note’s password — not by encryption we cannot undo.

The administrator of the service sees the account details needed to run and protect it (such as your e-mail address and the sign-in and sign-up details above), an overview of your notes (their titles, size, dates and whether they are shared or protected), an overview of shares, and uploaded pictures (to manage storage and remove unlawful content). The administrator can open the content of a note only in justified cases, for example to investigate abuse or a problem you reported, and every such access is recorded in an audit log. This also applies to a note you have protected with a password: the password keeps the note from other people who use your device or open a link to it, but it is not encryption, and the opening of a protected note is recorded separately. End-to-end encrypted notes cannot be opened by the administrator at all — not even their titles.

4. Why we process it (legal bases)

We process personal data on these bases under Article 6 of the GDPR:

• Performance of a contract (Art. 6(1)(b)): your account and signing in, storing and syncing your notes, sharing, end-to-end encryption, and the e-mails the service has to send.
• Legitimate interests (Art. 6(1)(f)): keeping the service secure and preventing abuse (sign-in and sign-up details, rate limits and blocking), the record of administrator actions, fixing the problems you report, and anonymous language statistics.
• Consent (Art. 6(1)(a)): analytics cookies (Google Analytics) — only after you accept them; you can withdraw your consent at any time.

5. Cookies and storage in your browser

We use cookies the service needs to work and cookies that remember your settings. Analytics cookies are set only if you accept them in the cookie banner — without your consent, the analytics script is not loaded at all.

Browser storage: the app keeps a few settings in your browser’s local storage — the theme, your cookie choice, the width of the panels, which folders are expanded, and that you dismissed a notice. They never leave your device.

Encryption key: if you use end-to-end encryption and choose “Keep unlocked on this device”, your key is kept in the browser’s database (IndexedDB) in a form that scripts cannot read out. It is removed when you lock encryption or sign out.

When you write without an account, the browser briefly keeps the text of the open tab so that it survives a trip to the sign-up page; this draft is limited in size and time and stays in your browser. Access keys to notes are never put into browser storage. Besides that, the browser remembers only that you closed the sign-up card in the sidebar.

6. Who we share data with

Only as far as necessary, with these providers:

• Hosting provider: the servers that run the service and store its data are located in the European Union.
• Google: only if you sign in with Google (OAuth 2.0), or if you accept analytics cookies (Google Analytics). Google may process data in the USA under the EU–U.S. Data Privacy Framework; see Google’s Privacy Policy.
• E-mail delivery provider: receives the recipient’s address and the message, only to deliver the service’s e-mails.

We do not sell, rent or otherwise share your personal data with anyone else.

7. How long we keep data

We keep your data for as long as your account exists. When you delete it (Settings → Your data → Delete account), your account, notes, pictures, folders, tags and problem reports are deleted permanently.

A session expires after 30 days without use, or as soon as you sign out or end it in the settings. Version history keeps a limited number of recent versions of each note. A problem report is kept until it has been dealt with and deleted, and at the latest until your account is deleted. Records of administrator actions are kept for accountability and can contain your e-mail address.

Notes written without an account are kept for 180 days from the last time their owner opened or edited them; each such opening restarts the period. Reading a note through a share link, an administrator’s preview and technical requests do not extend it. After that, the note stops being reachable and is deleted. What you move to the trash is deleted permanently after 7 days. Each note shows its own date in the app, and once you attach a note to an account, this rule no longer applies to it.

Backup copies may be kept for the limited time needed to keep the service running, and are protected by the same security measures.

8. Your rights

Under the GDPR, you have these rights:

• Access: you can ask for a copy of the personal data we hold about you; most of it you can download yourself in Settings → Your data → Export your data.
• Rectification: you can change your name and e-mail address in the settings, or ask us to correct anything else.
• Erasure: you can delete your account at any time in Settings → Your data → Delete account.
• Portability: download everything as one JSON file in Settings → Your data → Export your data, or any note as Markdown, plain text or PDF.
• Restriction: under certain conditions, you can ask us to restrict the processing of your data.
• Objection: you can object to processing that is based on legitimate interests.
• Withdrawing consent: you can change your cookie choice at any time with the button in the cookies section.
• Complaint: you can lodge a complaint with a supervisory authority — in the Czech Republic, the Office for Personal Data Protection (www.uoou.cz).

9. How we protect data

Connections are encrypted (HTTPS). Passwords are stored as salted hashes, sessions as hashes of their tokens, and two-factor secrets encrypted. Sign-in attempts are rate-limited, and you can protect individual notes with a password or encrypt them end-to-end.

10. How to delete your data

Sign in and open Settings → Your data → Delete account. After you confirm, your account and everything in it is deleted immediately and permanently.

You can also e-mail us at info [at] mynout [dot] com and we will delete your account within 30 days.

If you write without an account, delete a note in the editor and then delete it permanently from the trash. “Forget this browser” also offers to delete every note of the profile at once; on its own it only disconnects the browser — the notes stay on the server and a private link still opens them.

11. Contact

For any question, request or objection about personal data: info [at] mynout [dot] com.