Privacy Policy

Last updated: February 18, 2026

1. Introduction

WhateverNote ("we", "our", "us") operates the website whatevernote.com and related applications. This Privacy Policy explains how we collect, use, and protect your information when you use our service.

2. Information We Collect

We collect the following information to provide and improve our service:

• Account information from OAuth: When you sign in with Google or Microsoft, we receive your email address and display name. Google sign-in also provides your profile photo URL.
• Note content: The notes you create and edit within the app, stored as CRDT binary data for synchronization.
• Device identifiers: A randomly generated client ID (8 characters) used to identify your devices for sync purposes.
• Authentication tokens: JSON Web Tokens (JWT) and refresh tokens generated by our server to manage your sessions.
• User settings: Your app preferences, stored to provide a consistent experience across devices.

3. How We Use Your Information

We use the information we collect to:

• Authenticate you and maintain your sessions
• Display your profile information within the app
• Synchronize your notes across your devices
• Maintain and improve the service

We do not sell, share, or use your data for advertising purposes.

4. Data Storage

Your data is stored in the following locations:

• Server: PostgreSQL database. Note content is stored as binary CRDT data.
• Desktop app: Local SQLite database for notes. Authentication tokens are stored in your operating system's secure keychain.
• Web app: Browser localStorage for authentication tokens and profile data. IndexedDB for offline note storage.

5. Third-Party Services

We use the following third-party services for authentication only:

• Google OAuth: For sign-in. We receive your email, name, and profile photo. Google's Privacy Policy.
• Microsoft OAuth: For sign-in. We receive your email and name. Microsoft's Privacy Statement.

No data beyond what is necessary for authentication is shared with these providers.

6. Data Retention

Your data is retained for as long as your account is active. When you delete a note, it is soft-deleted and recoverable for 30 days, after which it is permanently removed. Deletion records (tombstones) are cleaned up after 90 days.

7. Your Rights

Under the General Data Protection Regulation (GDPR) and applicable Italian law, you have the right to:

• Access the personal data we hold about you
• Rectify inaccurate personal data
• Request deletion of your personal data
• Export your data in a portable format
• Restrict or object to processing of your personal data

To exercise any of these rights, contact us at [email protected].

8. Cookies & Local Storage

WhateverNote does not use cookies. We use browser localStorage to store authentication tokens and your user profile, and IndexedDB for offline note storage. All locally stored data remains on your device unless explicitly synced to our servers.

9. Children's Privacy

WhateverNote is not directed at children under the age of 16. We do not knowingly collect personal information from children under 16. If you believe we have collected such data, please contact us at [email protected].

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last Updated" date at the top of this page. We encourage you to review this policy periodically.

11. Contact

If you have questions about this Privacy Policy, contact us at [email protected].