Privacy Policy

1. Local-First Architecture & Storage

All notes, folder hierarchies, tags, and workspace configurations created in PureNotes are stored entirely on your device inside your browser's local storage (localStorage and IndexedDB).

At no point is your content transmitted to any remote servers, cloud infrastructure, or third-party storage during typical creation, editing, or deletion workflows.

2. When Data Leaves Your Device (Voluntary Sharing)

Your data leaves your device only and exclusively when you explicitly click the "Share" button to generate a public share link:

• Serverless Share Endpoint (/api/share): When you choose to share a note, only the specific note title, markdown content, and tags for that individual note are transmitted to Cloudflare Pages Functions and stored in Cloudflare KV under a randomly generated key.
• Offline Hash Sharing Fallback: If the network request is unavailable, the shared note payload is encoded entirely into the URL fragment hash (#share=...). In this mode, zero data reaches any server; the note is decoded directly in the recipient's browser.
• Encrypted Notes Protection: Notes secured with client-side AES-256 encryption are never synced or uploaded to public share endpoints unless you explicitly decrypt and share them.

3. Client-Side Cryptographic Security

When you apply encryption to a note, PureNotes uses the browser's native Web Cryptography API (crypto.subtle) with AES-256-GCM and PBKDF2 key derivation (100,000 iterations).

Your passphrase is never sent over any network and is never stored anywhere on disk. Only the cryptographic ciphertext, initialization vector (IV), and salt are written to your browser's storage. If you lose your passphrase, neither we nor any third party can recover your encrypted notes.

4. Zero Tracking, Analytics, and Advertising

We respect your privacy unconditionally:

• No Tracking Scripts: We do not use Google Analytics, Plausible, Mixpanel, Hotjar, or any visitor tracking technologies.
• No Cookies: PureNotes sets no tracking or marketing cookies.
• No Advertisements: There are no advertising banners, sponsored content, or ad-tech SDKs.
• No Fingerprinting: We do not collect device identifiers, IP logs, or behavioral telemetry.

5. Third-Party CDNs

To deliver an optimal, lightweight standalone experience, PureNotes loads open-source libraries (Tailwind CSS, Marked.js, DOMPurify, Skulpt) and web fonts via public content delivery networks (Google Fonts, Cloudflare CDNJS, jsDelivr). These CDNs may log standard technical HTTP connection metadata (such as IP addresses and browser user-agent) in accordance with their respective privacy policies.

6. Data Ownership, Backups & Deletion

You retain absolute, exclusive ownership of your data at all times. Because all data is housed on your local machine, you have complete authority to:

• Export Full Vaults: Create portable JSON backups of your notes, folders, and preferences at any time from Settings.
• Export Individual Files: Save notes as standard .md or printable PDF files.
• Permanently Delete: Clear your browser's site data or delete individual notes to instantly remove them from your device.

7. Contact & Changes

Because PureNotes does not store personal accounts or cloud credentials, this Privacy Policy remains simple and steadfast. Any updates will be reflected directly on this page with an updated revision date.