Privacy policy

Last updated: October 30, 2026

We keep what is needed for you to have an account and for your notes to work. No ads, no analytics, no selling of data.
Your data is stored on servers in the European Union (Ireland).
If you turn on end-to-end encryption, the content of your notes is encrypted on your device and we cannot read it.
You can export your notes to Markdown and delete your account at any time from the app itself.

1. Who is responsible

The controller of your data in Noos (the Android and iPhone app and the website usenoos.com) is Fabio Infante Cerezo, in Spain.

For anything about your data, write to privacidad@usenoos.com.

2. What data we keep

Data	What it includes
Account	Email, password (only stored as a hash, never in plain text), first name, last name, username and date of birth.
Preferences	Language, light or dark theme, and whether you have seen the tutorial.
Your content	Spaces, notes (title, summary, text and links to sources), tags, relation types, relations between notes and maps, with the position of each note and the view you left. With end-to-end encryption on, we store it encrypted (section 7).
Sharing	Who is a member of each space and with which role, invitations (for each link we only keep an encrypted fingerprint, not the link) and who is editing a note at any given moment.
End-to-end encryption (if you turn it on)	Your public key and, encrypted, your account key and your private key: we cannot open them without your 12 words or one of your devices. Also the list of linked devices (type, date added and date last used) and, encrypted for each member, the key of each encrypted space.
Technical data	The servers log the IP address, the browser or device and the time of each request. Your session stores the IP and browser you signed in with. If something fails, the app sends a report with an error code, the operation that failed and the platform, without the content of your notes.
On your device	The app stores your session and a copy of the content you have opened, so you can read it offline. That copy is deleted when you sign out. With encryption on, the device also keeps your account key in its secure storage, and it is also deleted when you sign out. The usenoos.com pages remember the language you choose. We do not use advertising or analytics cookies.

What other people see

In a shared space, members see your name and who edited each note. The owner of the space also sees your email.
If you publish a map with a public link, anyone with that link sees the notes in that map, without authors or emails. You can turn the link off at any time. If the space is encrypted, the key to open the map is in the link itself, after the #, and never reaches our servers.

3. What we use it for and on what legal basis

Providing the service: creating and keeping your account, saving and syncing your content across devices, sharing spaces, publishing maps and sending account emails (verification, password reset). Legal basis: performing the service you ask for when you create the account (Art. 6(1)(b) GDPR).
Checking the minimum age with your date of birth (section 8). Same legal basis.
Security and proper operation: usage limits, blocking accounts that abuse the service and logging errors to fix them. Legal basis: our legitimate interest in keeping the service secure and working (Art. 6(1)(f) GDPR).

We do not use your data for advertising, we do not build profiles, we do not make automated decisions about you and we do not sell or share your data.

4. Who else processes your data

We use these providers, who process the data only to provide their service to us and under their data processing agreements:

Provider	What for
Supabase	Database, sign-in and the app's API. Data is stored on servers in the European Union (Ireland).
Cloudflare	Hosts and serves the usenoos.com website. It sees the IP and the requests to the website.
Resend	Sends account emails. It receives your email address and the content of that message.
Google Fonts	Only in the web version of the app: when it opens, the browser downloads a fallback font from Google's servers and, if a text needs them, the fonts for emoji, symbols or other alphabets. Google receives your IP. The Android and iPhone apps don't connect to Google.

These companies are based in the United States. If any of them transfers data outside the European Economic Area, it does so with the safeguards required by the GDPR, such as the European Commission's standard contractual clauses.

We would only give data to an authority if a law or a court order required us to.

5. How long we keep it

Account and content: while you have the account.
Trash: what you delete can be restored for 30 days; after that it is deleted forever.
When you delete your account, the account, the profile and your spaces with all their content are deleted immediately. Notes you wrote in other people's spaces stay in those spaces, without your name. More detail in Delete your account.
Error reports: 90 days.
Expired or revoked invitations: deleted after 30 days.
End-to-end encryption keys: while you keep it on. When you turn it off, the app first decrypts your spaces and then the keys are deleted.
Blocks and deletions made by administration: a record of the action is kept with the account's email and username, for as long as it is needed for the security of the service.
Providers' technical logs (IP, browser): a few days, according to their terms.

We do not keep our own backups of the database, so what is permanently deleted cannot be recovered.

6. Your rights

You can ask at any time to access your data, correct it, delete it, restrict its use, object to its processing or take it with you.

To delete it, use “Delete account” in the app (how to do it).
To take it with you, export your spaces, maps or notes to Markdown from the app.
For anything else, write to privacidad@usenoos.com from your account's email. We reply within one month at most.

If you think we are not handling your data properly, you can complain to the Spanish Data Protection Agency (aepd.es) or to the authority in your country.

7. Security

All connections are encrypted (HTTPS).
On every request, the server checks that you are allowed to see or change each space, note and map.
Passwords are only stored as a hash.
End-to-end encryption (optional). You turn it on in your profile. With it, the title, summary, text and sources of your notes and the names of your spaces, maps, tags and relation types are encrypted on your device (AES-256-GCM) before they are sent, and we cannot read them. We can still see each note's icon and color, the positions on the maps, which notes link to each other, dates, sizes, the members of each space and your account details.
If you lose all your linked devices and your 12 words, the encrypted content cannot be recovered: we cannot do it either.
Without encryption turned on, whoever runs Noos has technical access to the database. We do not look at the content of your notes unless it is needed to solve a problem you ask us about or a legal obligation requires it. The admin panel only shows account details and usage figures.

8. Minors

Noos is not meant for children under 14. You must be at least 14 to create an account: the app checks your date of birth and doesn't let anyone younger sign up.

9. Changes to this policy

If we change anything important, we will publish it here with the new date and, if it affects how we handle your data, we will let you know in the app or by email.