Privacy policy

VoidNote is run by Quantum Encoding Ltd, a company registered in England and Wales (Company No. 16575953), registered office 33 Oxford Street, Coalville, LE67 3GS, United Kingdom. Quantum Encoding Ltd is the data controller for the personal data described here.

1. What we collect

Notes. The encrypted content, its initialisation vector, which key derivation it uses (plain, or password-protected), its view limit and view count, and its creation and expiry times. If you were signed in when you created it, the note is linked to your account; otherwise it has no owner. Notes are encrypted on your device and stored without their key. In a /n/…#key link the key sits after the #, which browsers never send to us, so we cannot read the note. Older /note/… links carry the key in the path: when one is opened, our server uses it to decrypt the note in memory and returns the text, and the key and the plaintext are not stored. Notes created that way may also have an optional title, stored in plain text. See How it works.

Creating a note without an account. You don't give us a name, an email address or anything else, and no cookie is set. To limit abuse we count requests per IP address. Your IP address (for IPv6, only its /64 prefix) is the key of that counter. The counter holds no note content and is deleted within about a day. The same kind of counter applies when you read a note, sign in, register, join a stream or report a link.

Accounts (optional). Username, optional email address and whether it is verified, a PBKDF2 hash and salt of your password (we never store the password itself), a hash of your API key if you generate one, team membership and role, and the date you registered.

Sessions. When you sign in, a signed session token is kept on our side and a session id is stored in a secure, HTTP-only cookie (vn_session). Sessions end after 72 hours or when you log out.

Streams, vault and teams (accounts only). For streams: the encrypted messages, an optional title, the expiry, and a hash of the stream password if you set one. The stream link carries its key in the path, so the key reaches our server with each stream request; it is not stored. For vault files: the encrypted file, its file name, size, and upload, expiry and download times. For teams: the team name, its members and their roles, and the email addresses you send invitations to.

Device inbox. "Send to my devices" in older versions of the mobile apps saves the full link, key included, and an optional title to your account until one of your devices collects it.

Abuse reports. Anyone can report a link. We store the reported link's token and type, the reason you choose, any details you write, the contact email if you give one, and the link's key only if you choose to include it so we can check the content. We are notified by email of the report's number, reason, link type and token; the email never contains the key, your details or your contact address.

Support email. If you email us, we keep your address, any VoidNote username it matches, the subject, and the beginning of your message and of our reply.

Payments. VoidNote doesn't take payments at the moment, so we collect no payment details.

2. What we do not collect

• • The key or password for any /n/ note — they never reach us
• • Tracking cookies, analytics, advertising pixels, or behavioural data
• • Who opened a note — reading one only touches the short-lived rate-limit counter described above

Your browser's local storage keeps your light or dark theme choice and whether you dismissed the cookie notice. That stays on your device.

3. How we use your data

• • Store and deliver notes, streams and vault files, and enforce their view limits and expiry
• • Authenticate you and maintain your session
• • Limit abuse with rate limits
• • Send email verification and team invitation emails, and answer support requests
• • Investigate and act on abuse reports
• • Run the hourly cleanup job that deletes expired data

We use this data to provide the service you ask for and to keep it safe from abuse. We do not sell, rent, or share your data with third parties for marketing.

4. Third-party services

Our fonts are served from voidnote.net, not from a third party.

5. Data retention

• • Notes — deleted on the last allowed view, or at expiry: up to 7 days for notes created without an account, up to 30 days with one. An hourly job removes expired notes. No archive.
• • Streams — messages are deleted once the stream is closed or expires; the stream itself is deleted at expiry.
• • Vault files — the encrypted file is deleted after it is downloaded or when it expires. The record of its name, size and dates stays with your account, because it counts toward your monthly upload allowance, until you delete your account.
• • Rate-limit counters — deleted within about a day of your last request.
• • Sessions — end on logout or after 72 hours.
• • Account data — kept until you delete your account (see below).
• • Abuse reports and support emails — kept as a record of what was reported or asked and how we handled it. You can ask us to delete your contact details from them.

6. Deleting your account

You can delete your account at any time in the VoidNote app or at voidnote.net/account/delete. Deletion is immediate and removes your account together with your notes, streams and their messages, vault files, device inbox, teams you own (their other members are released), invitations you sent, your team memberships and your API key, and signs you out.

Deleted data can remain in our hosting provider's database recovery copies for up to 30 days before it is gone for good. If payments were ever made from an account, the record of those payments is kept where tax law requires it, and the account entry they refer to is stripped of your username, email address and every other identifier.

7. Your rights (GDPR)

If you are in the EEA or UK, you have the right to access, rectify, erase, or port your personal data, and to restrict or object to processing. To exercise these rights, contact us at the address below. We will respond within 30 days. You can also complain to the UK Information Commissioner's Office (ico.org.uk) or, if you live in the EEA, to the data protection authority where you live.

If you registered without an email, you can only contact us from the registered account — we have no other way to verify identity.

8. Security

Notes are encrypted on your device with AES-256-GCM. A note password is turned into a key with PBKDF2-SHA256 (600,000 iterations) on your device. Sessions are signed with post-quantum ML-DSA-65 signatures. Account passwords are hashed with PBKDF2-SHA256 (100,000 iterations) and a per-user salt. All traffic is served over HTTPS via Cloudflare.

9. Changes

When we change this policy we update the date at the top of this page. If you have an email address on file and the change is significant, we will tell you by email.

10. Contact

Questions about this policy: privacy@voidnote.net