Privacy policy

Notes, attachments and request replies

Notes, attachments and replies to information requests are encrypted in the browser before they reach us. We store the encrypted data and its settings (expiry, views remaining, whether a password was used). We cannot decrypt any of it. A note is deleted when its last allowed view happens, when it expires, or when it's destroyed early. A request reply is deleted when the requester opens it. Expired items are removed within an hour, and encrypted files within about 15 minutes of their note being deleted.

If you create an account

We store:

• your name, email address and team;
• a derived value that lets us check your password at login. Your password itself never leaves your browser, so we can’t recover it;
• the titles, password hints and messages you give notes and requests. These aren’t encrypted, so never put secrets in them;
• activity history for your notes and requests: when they were created, emailed, opened or downloaded, failed password attempts, and the country each event came from. We never store IP addresses;
• if you turn on push notifications, the delivery address your browser gives us for this device;
• your team’s company name and logo, if you add them.

History is kept for your plan’s retention period (7 days on Free, 6 months on Standard, 12 months on Business) and then deleted. On the Free plan a note’s history is deleted as soon as the note is read. Deleting your account deletes all of this immediately.

Email addresses of other people

If you email a note or request link to someone, we use their address once to send that email and don’t keep it. Quick notes from the home page can store your own address for a read notification; it’s deleted with the note.

Cookies

If you log in, we set one cookie that keeps you signed in. That’s the only cookie we set. No tracking, advertising or analytics cookies, ever.

Technical data

Like every website, we receive your IP address and basic request information. We use your IP address briefly for rate limiting to prevent abuse, and we don’t store or log it. We have turned off request logging on our hosting platform so note links aren’t recorded.

What we don't collect

• Never your notes’ text, attachments, keys or passwords.
• No phone numbers, payment cards (we don’t take online payments yet), or advertising identifiers.
• No third-party analytics, fonts or tracking pixels.

Service providers

• Cloudflare: hosting, database and file storage. Cloudflare Turnstile checks that sign-ups and password resets come from people, on those pages only.
• Resend: delivers our emails.
• Your browser’s push service (for example Google, Mozilla, Apple or Microsoft) delivers push notifications if you turn them on. They’re encrypted so the push service can’t read them.

Each acts on our behalf and only handles the data described above.

Your rights

You can see, change and delete your account data from your dashboard at any time. For anything else about your data, contact hello@vanishnote.example.

Changes

If we change this policy, we'll update this page and the date at the top.