Privacy Policy

Only what the service needs to work:

• Your account — the name you enter, your email address, and your password stored only as a cryptographic hash. We never store your password in a readable form.
• Your profile — anything you choose to add, such as a photo, tagline, organisation, bio and the personal details you tick to display.
• Messages you receive — the subject and body someone writes to you, and when it arrived.
• Technical data — ordinary server logs (IP address, browser, timestamps) used to keep the service running and to stop abuse.

The recipient never learns who sent a message. A message is stored without any sender identity attached to it, and nothing in the product — the inbox, notifications, exports — can reveal it.

• To deliver messages to the person you sent them to.
• To let you sign in, recover your password and manage your profile.
• To notify you about new messages through the channels you switch on.
• To detect spam and abuse, and to act on reports.
• To keep the service secure, available and working.

We do not sell your data, and we do not use your messages to target advertising.

We share data with the service providers that run ConfiNotes for us — hosting, database, email delivery and the object storage that holds profile photos — and only what each needs to do its job. We may also disclose information where the law requires it, or to protect someone from serious harm.

Messages have no expiry date; they stay in your inbox until you delete them. Deleting a message removes it from your account. If you want everything cleared at once, contact [email protected]. Closing your account removes your profile, your link and the messages you have received.

• Choose which profile fields visitors can see, on your Profile page.
• Turn each notification channel — push, email — on or off independently.
• Ask for a copy of your data, or ask us to correct or delete it.
• Delete individual messages, or your whole account, at any time.

We use a cookie to keep you signed in, and your browser's local storage to remember preferences such as your light or dark theme. We do not use third-party advertising trackers.

Passwords are hashed, attribution records are encrypted, and access to production data is restricted and audited. No service can promise perfect security, but we design for the assumption that a database copy alone should never expose who sent what.

If this policy changes in a way that materially affects you, we will say so in the app. Questions, requests or complaints: [email protected].

See also our Terms of Service.