What we collect
-
Email address: used to identify your account and send you check-in reminders and vault delivery notifications.
-
Name (optional): displayed to your recipients when they receive vault content.
-
Vault content: your notes and files, stored encrypted. We don't read them. Unlike Sealed Vault, Notenz holds the key needed to deliver your vault automatically, so we technically could. See our Security page for details.
-
Check-in settings: your check-in interval and grace period preferences.
-
QR-Vault PIN (Guardian): if you generate a QR-Vault, we store a bcrypt hash of your 6-digit PIN. We never store the PIN itself in a readable form.
-
IP address and basic request logs: retained briefly for security and debugging. Not used for tracking or advertising.
What we do NOT collect
- ✗ We do not use advertising trackers or pixels
- ✗ We do not share your data with third-party advertisers
- ✗ We do not read the plaintext of your vault content
- ✗ We do not build profiles for marketing purposes
Third-party services we use
We use a small number of specialist providers to run Notenz. Each only receives the minimum data needed for its job, and each has its own data protection agreement with us.
-
Resend: email delivery. Your email address is shared with Resend to send you notifications.
-
Lemon Squeezy: payment processing. Lemon Squeezy handles billing; we do not store your card details.
-
Supabase: database hosting for your account and vault data, and encrypted file storage for vault file attachments. Files are encrypted before they reach this storage.
-
DigitalOcean: application hosting (the servers that run Notenz).
-
Telegram: if you connect your Telegram account for check-in alerts (Pro/Guardian), your Telegram chat ID is stored so we can send you notifications.
-
Sentry: error tracking, so we can find and fix bugs. Error reports are scrubbed of vault content and sensitive fields before being sent.
-
Umami: privacy-friendly website analytics. Cookieless, no personal data or cross-site tracking.
How long we keep your data
Your data is retained while your account is active. The table below covers each data type:
-
Vault notes and files
: Until you delete them, or 30 days after vault execution, or 30 days after subscription freeze, whichever comes first.
-
Two-Person Secret file copies
: When a file vault item is delivered as a Two-Person Secret, an encrypted copy is stored temporarily to allow any 2 of the recipients you selected to coordinate and download. This copy is retained for up to 90 days from vault execution, then permanently deleted. The copy is stored encrypted; Notenz cannot read its contents.
-
Account data (email, settings)
: Until you delete your account, or 30 days after vault execution.
-
Execution audit record
: Kept indefinitely. This is a minimal record only, containing your email address, execution date, deletion date, and item count. No vault content is included.
-
Activity log (audit events)
: Retained for the lifetime of the account. Deleted with the account.
-
Billing records
: Retained for up to 7 years to comply with financial regulations.
If you delete your account manually, all vault content, recipients, and personal data are permanently deleted within 30 days.
Your rights (GDPR)
If you are in the EU or UK, you have the right to access, correct, or delete your personal data. You can do most of this yourself from the dashboard. For anything else, email us.
You also have the right to data portability and to object to processing. We will respond to requests within 30 days.
Cookies
We use a single session cookie to keep you logged in. We do not use third-party cookies or tracking cookies of any kind.