SyncNotes - Privacy Policy

1. Introduction

SyncNotes ("we", "us", "our") respects your privacy. This Privacy Policy explains how we collect, use, and protect your information when you use our Service.

SyncNotes is currently in beta, so we may adjust infrastructure, limits, and workflows as we improve reliability and the overall product experience.

2. Information We Collect

Account Information

Email address (for login, verification, and communication)
Username
Hashed password (we never store plaintext passwords)

Vault Data

Notes and attachments you sync via Obsidian LiveSync
Storage usage metadata

Billing Information

Payment processing is handled by Lemon Squeezy (our Merchant of Record)
We store only subscription status and identifiers; we do not store credit card numbers

Usage & Technical Data

IP addresses (for security and abuse prevention)
Server logs (request timestamps, errors)

3. How We Use Your Information

To provide, maintain, and improve the Service
To process payments and manage subscriptions
To send transactional emails (verification, password reset, billing notices)
To communicate important service updates
To detect and prevent abuse or unauthorized access

We do not sell your personal information to third parties.

4. Data Storage & Security

Your vault data is stored in RustFS object storage.
Data is transmitted over HTTPS (TLS encryption in transit).
LiveSync end-to-end encryption (E2EE) is optional in both Quick Setup and manual configuration. Without E2EE, uploaded notes may be readable by the service operator.
You can enter an E2EE passphrase or generate one in your browser. Quick Setup submits the Setup URI passphrase and any E2EE passphrase to our server over HTTPS to generate the encrypted setup link; we do not store or recover these passphrases. The manual configuration passphrase field does not submit its value to SyncNotes.
Access credentials for your vault are generated uniquely for you.
We implement industry-standard security practices, but no system is 100% secure.
During beta, we may review service logs and operational metrics more actively to diagnose reliability issues.

5. Data Retention

We retain your data as follows:

Active accounts: Data is retained while your account is active.
Trial expiration: If you do not subscribe after your month-long beta trial, your vault becomes read-only for 14 days and is then permanently deleted.
Subscription cancellation or expiry: After your paid period ends, your vault becomes read-only for 30 days before deletion.
Account deletion: You may request deletion at any time; data will be removed within 30 days.

During read-only retention you can download existing data, but you cannot upload, modify, or delete remote objects. We attempt to send email warnings before scheduled expiry deletion, but delivery or receipt is not guaranteed and does not extend the deadline shown in your dashboard.

6. Third-Party Services

We use the following third-party services:

Lemon Squeezy – Payment processing (Merchant of Record). See their Privacy Policy.
Resend – Transactional email delivery.

7. Your Rights

Depending on your jurisdiction, you may have the right to:

Access the personal data we hold about you
Request correction of inaccurate data
Request deletion of your data
Export your data (your notes can be exported via Obsidian at any time)

Contact us at support@syncnotes.dev to exercise these rights.

8. Cookies

We use essential cookies for authentication and session management. We do not use third-party tracking or advertising cookies.

9. Children's Privacy

The Service is not intended for users under 16 years of age. We do not knowingly collect information from children under 16.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or in-app notice. Continued use of the Service after changes constitutes acceptance.

11. Contact

If you have questions about this Privacy Policy, please contact us at support@syncnotes.dev.