The paperwork
Written to be read.
Four documents. No paragraph of hedging where a sentence of fact would do, and a straight answer wherever the design means we cannot do something you might expect.
All four took effect on 20 September 2026 · Revision 1.1
- The agreement
Terms of Service
What you agree to when you keep a ledger here, and what we promise in return.
Read it - What we hold
Privacy Policy
Field by field: what is encrypted beyond our reach, what stays readable, and who else sees anything.
Read it - Machines and your notes
AI Policy
One AI feature exists, it is switched off in the hosted app, and nothing you write trains a model.
Read it - Your rights
Data Protection & GDPR
Who controls what, the rights you have, and an honest account of which ones we can technically serve.
Read it
The short answers
If you came here with one question, it is probably one of these. Each links to the clause that says it properly.
- Can anyone at Notchr read my ledger?
- No. Names, notes, photos and places are encrypted on your device with a key only your passkeys can open. We hold the ciphertext and not the key. The clause →
- What can you read?
- Timestamps, ratings, ordinal numbers, heights, the names of activity types you create, and the technical records of your passkeys and sessions. The full list is published. The clause →
- What happens if I lose my passkeys?
- The ledger is gone. There is no reset, no recovery code and no backup we can decrypt. Register a passkey on more than one device. The clause →
- Does an AI read my notes?
- No. The one AI feature is refused outright on the hosted service, because the server cannot read your notes in the first place. The clause →
- Who else sees anything?
- Cloudflare in front of the service, which also stores your photos as ciphertext it cannot open, Google Fonts for the lettering, OpenStreetMap if you open the Map, and Stripe if you subscribe. There is no analytics, advertising or tracking of any kind. The clause →
- How do I delete everything?
- Ask us — quote the account reference from your Settings page — and we delete the account and every row within 30 days. Or delete the entries and remove your passkeys, and what remains is unreadable by anyone forever. The clause →
Anything else
Ask a person.
Data requests, security reports, complaints, or a clause that reads badly — all of it goes to one address, and a person reads it.
[email protected]