Who we are
We run FirmNotes and are responsible for the account and sync data described here. Contact: [email protected].
What we collect
On your device only: your notes, tasks, reviews, text size, and list preferences. They live in your browser's storage. We cannot see them unless you sync or export.
With an account: your email address, and your password in a scrambled (hashed) form. We never store it in plain text. Your synced notes and reviews. The Terms and Conditions and Privacy Policy versions you accepted, and when you accepted them.
Technical data: when the app loads or syncs, our hosting and database providers receive standard request details, such as your IP address, browser type, and the time. They keep these logs for security and to keep the service running.
When you set a password: the app sends the first five characters of the password's SHA-1 hash to the Have I Been Pwned range service, to check for known breaches. The full password never leaves your device.
Why we use it, and the legal basis
To run your account and sync your notes, because you asked us to (performing a contract). To keep the service secure and stop abuse, which is our legitimate interest. To meet a legal obligation where one applies.
FirmNotes has no analytics, advertising, or third-party tracking. If we ever add marketing, we will ask for your separate, unticked consent first.
Who processes your data
Supabase stores accounts and synced notes, in the Singapore region. Cloudflare hosts the app and sees request details. Brevo sends sign-up confirmations and password reset emails, so it processes your email address. Have I Been Pwned receives only the partial hash described above.
We do not sell your data.
International transfers
Our providers may process data outside your country. Where the law requires it, they rely on recognised safeguards, such as standard contractual clauses.
How long we keep it
We keep your account and synced data until you delete it, or ask us to delete it. Security logs are kept for a short period set by our providers. Local notes stay on your device until you delete them or clear the browser's data.
Your choices and rights
You can use FirmNotes without an account, and keep everything on your device.
You can download a backup of every note at any time, in Settings.
You can ask us for a copy of your data, to correct it, to delete your account and synced data, or to restrict or object to how we use it. Email [email protected]. We will reply within one month, as the GDPR and UK GDPR require.
You can complain to the data protection authority where you live.
Children
FirmNotes is for people aged 13 and over. Some countries set a higher minimum age for online services. If you live in one, you must meet that age. If we learn that an account belongs to a younger child, we will delete it.
Security
Data travels over HTTPS. Synced notes are not end-to-end encrypted, so our hosting and database providers can read them. Passwords are hashed. Database rules let each person read only their own rows. Passwords are checked against known breaches. No service is completely secure, so keep your device and password safe.
Changes and contact
We will change the version date above when this policy changes, and tell you in the app about significant changes. Contact: [email protected].