Privacy Policy
Effective date: 2026-06-11
Last updated: 2026-07-29
1. Who we are
Slote ("we", "us", "our") is a note-taking application developed and operated by Christopher Lee, an individual developer ("Developer"). You can reach us at:
- Email: support@slote.io
- Website: https://slote.io
2. What this policy covers
This policy describes how Slote collects, uses, stores, and shares information when you use the Slote mobile and desktop application ("the App"). It applies to all platforms on which Slote is available (iOS, Android, Windows, macOS).
3. Information we collect
3.1 Information you provide directly
| Data | Why we collect it |
|---|---|
| Email address | Account creation, sign-in, password reset, and the inbound email-to-note address (<alias>@inbound.slote.app). |
| Username / display name | Shown in note-sharing attribution ("Shared by @username"). |
| Note content | Text, headings, lists, tables, and other rich-text blocks you write in Slote. Stored locally and, when you are signed in, synced to our servers. If you have set up an encryption passphrase, it is encrypted on your device before upload; if you have not, it is stored in readable form on our servers. See §6.1 — this distinction matters. |
| Drawing data | Ink strokes you make on notes. Stored and synced alongside note content, and encrypted on the same terms (§6.1). |
| Images | Photos or images you explicitly paste or pick into a note. Stored locally; uploaded to our servers when signed in, and encrypted on the same terms (§6.1). |
| Profile photo | If you choose to set one, uploaded to our servers (stored privately; not end-to-end encrypted — low sensitivity, used for cross-device display). |
3.2 Information collected automatically
| Data | Why we collect it |
|---|---|
| Device push token | A Firebase Cloud Messaging (FCM) registration token stored per device. Used exclusively to route push notifications for note-sharing events to your device. |
| App platform and version | Recorded when registering a device for push notifications so we can route FCM payloads correctly per platform. Not transmitted to any analytics service. |
| Sync metadata | Timestamps (created_at, updated_at, sync_status) attached to your notes and folders so multiple devices stay in sync. See §6.3 for the full list of what our servers can see. |
| In-app diagnostic logs | Written to a local database on your device. They are uploaded to our servers only while Settings → Diagnostics → Share diagnostic logs is switched on, which is off by default. They record event tags, identifiers, counts, and error types — not the content of your notes. |
| Crash reports | The App can send crash and error reports to Sentry (see §5). This is controlled by a build-time setting rather than an in-app toggle, and is not enabled in current builds — no crash data is being sent today. If we enable it, reports will contain the error, a stack trace, the app version, and an opaque account identifier; they are configured never to include your email address or note content. We will update this policy's "Last updated" date when that changes. |
3.3 Payment information
Billing is handled entirely by Stripe. When you upgrade to Slote Pro, you enter payment details directly on Stripe's interface. We receive only a subscription status indicator (free / pro) and a Stripe customer ID. We never see or store your card number, CVV, or billing address.
3.4 Information we do NOT collect
- We do not collect precise or coarse location data.
- We do not collect contacts.
- We do not use any advertising SDKs or cross-app tracking.
- We do not sell or rent your data to any third party.
4. How we use your information
- Providing the service — syncing your notes across devices, sending push notifications when someone shares a note with you, enabling you to export and import notes.
- Account management — authentication, session restoration, account deletion.
- Billing — checking your plan tier to apply the storage and device limits for that plan; processing subscription events via Stripe webhooks.
- Security and abuse prevention — server-side rate limiting and RLS (Row-Level Security) policies that ensure you can only access your own data.
- Customer support — if you contact us, we may use your email and the information you provide to respond.
5. How we share your information
We share data only with the service providers listed below, all of which are contractually bound to process data only as directed.
| Provider | What they receive | Purpose | Privacy policy |
|---|---|---|---|
| Supabase | Account data, your notes and folders (as ciphertext where §6.1 applies, otherwise readable), images, shared-note payloads, and the server-readable metadata listed in §6.3 | Database, authentication, object storage, Edge Functions | supabase.com/privacy |
| Cloudflare (R2) | PDF files you import into notes, stored as encrypted objects in a private bucket | PDF file storage | cloudflare.com/privacypolicy |
| Google / Firebase | Device push token, notification payloads | Push notification delivery | policies.google.com/privacy |
| Stripe | Subscription events (no card data from us) | Billing and subscription management | stripe.com/privacy |
| Sentry (not currently enabled) | Crash and error reports: error type, stack trace, app version, opaque account identifier. Configured to exclude email addresses and note content. See §3.2 | Crash and error reporting | sentry.io/privacy |
| SendGrid (optional) | Inbound email bodies sent to your alias | Email-to-note inbound parsing | sendgrid.com/policies/privacy |
Where a row above says data is encrypted, the encryption key is derived on your device from your encryption passphrase and is not transmitted to us or to the provider — so the provider stores bytes that neither they nor we hold a key for (§6.1).
We do not share your data with anyone else unless required by law.
6. Security and encryption
6.1 How encryption works
Encryption is not optional for synced notes. The first time you sign in, Slote requires you to create an encryption passphrase, and you cannot reach your notes in the App until your encryption is unlocked. Everything you sync from that point on is encrypted on your device before it is uploaded.
The mechanism. Your encryption passphrase is separate from your login password; resetting your login password does not affect it, and we never receive the encryption passphrase. Your device uses it to derive a key with Argon2id (a deliberately slow, memory-intensive function, which makes guessing the passphrase expensive). That derived key protects a randomly generated account key. Each time a note is uploaded, your device generates a fresh key for that upload, encrypts the content with AES-256-GCM, and encrypts that per-note key under your account key.
What our servers receive is the encrypted bytes, plus copies of your keys that are themselves encrypted under keys we do not have. Your passphrase, the key derived from it, and your unencrypted account key never leave your device. We therefore do not hold a key that decrypts this content, and neither does Supabase nor Cloudflare.
This describes how the current version of the App works. It is not a promise about future versions — the App is what performs the encryption, so a future release could in principle behave differently. If we change this, we will change this policy and say so.
Your recovery key. When you set up encryption, Slote shows you a recovery key once. It is a second, independent way to unlock the same account key. We never receive it. If you lose both your passphrase and your recovery key, your encrypted notes cannot be recovered — not by you and not by us. There is no reset we can perform, because we hold nothing that would let us do it. Please store the recovery key somewhere safe.
Notes from earlier versions. Notes that synced before encryption existed in Slote may still be stored in readable form on our servers until they are migrated. The App can re-encrypt them (Settings → Encryption → Encrypt existing data). Until that runs for a given note, we are technically able to read it.
What encryption covers: note titles, note body text, ink drawings, text boxes, page-layout data, images you add to notes, PDFs you import, and the payloads of notes you share with another Slote user. Shared payloads are sealed to the recipient's public key using X25519 key agreement, so we do not hold a key for those either. When a note is shared with you, the App decrypts it on your device — our servers never do.
What encryption does not cover: see §6.3. In short, encryption protects the contents of your notes, not the facts about them — folder names, timestamps, sizes, and who you share with remain readable to us.
PDFs. PDFs you import are encrypted on your device and stored as encrypted objects in a private Cloudflare R2 bucket, under a path derived from your account and note identifiers; the original filename is not used. PDFs imported by earlier versions may still sit in our older storage bucket, which is private and access-controlled but not end-to-end encrypted.
Search runs entirely on your device against a local index. We do not operate a server-side index of your note content, and the text used for searching is never uploaded.
On your own device, notes are stored unencrypted in the App's private, sandboxed database and files. Your device's own disk encryption and app sandboxing protect them there. Your encryption key is held in your device's secure storage (iOS/macOS Keychain, Android Keystore, or the system credential store on Windows) only if you choose to trust that device, and that stored copy expires after 15 days. Backups you export with Backup all notes (.slote-bundle) are not encrypted — treat an exported bundle as readable by anyone who obtains the file.
6.2 Storage and credentials
- Local storage: Your notes are stored in a SQLite database on your device under the app's private container. Images are stored in the app's documents directory. Neither is accessible to other apps.
- Cloud storage: Synced data is stored on Supabase infrastructure (PostgreSQL database and object storage), and imported PDFs on Cloudflare R2. All connections use TLS. Storage buckets are private, and database access rules ensure no user can read another user's data. Note content is additionally encrypted on your device (§6.1).
- Credentials: Sign-in session tokens are stored in your device's secure storage (iOS Keychain / Android Keystore / system credential manager on desktop). Your login password is never stored by us — authentication is handled by Supabase Auth, which stores only a hash. Your encryption passphrase and recovery key are separate from your login password and are never transmitted to us.
- Supabase server region: [VERIFY IN DASHBOARD — state the Supabase project region here, e.g. "Southeast Asia (Singapore)". This is a blocking item: the sync script refuses to publish while this placeholder is present.]
No system is perfectly secure. In the event of a data breach that affects your personal information, we will notify you as required by applicable law. Content encrypted under §6.1 would be exposed only as ciphertext, which is not readable without your passphrase or recovery key; the information listed in §6.3 would be exposed in readable form.
6.3 What our servers can see
Encryption protects what is inside your notes. It does not hide the information our servers need in order to store, sync, and bill for them. We think you should be able to see that list rather than infer it, so here it is in full.
| Category | Readable to us |
|---|---|
| Account | Your email address, username, display name, profile photo, inbound email alias, and chosen accent colour. |
| Note records | That a note exists, its identifier, which account owns it, when it was created, last changed, and deleted; which folder it is in; whether it is pinned, archived, or in the trash; its position in your ordering; and its title font. |
| Folders | Folder names in readable form, along with the full folder tree — which folders exist and how they nest. Folder names are not encrypted. If you would not want a folder name read, do not put sensitive information in it. |
| Files | For each image: its file type, byte size, and storage path. For each PDF: its page count, byte size, and storage location. The file contents themselves are encrypted; their sizes are not, and size can hint at content. |
| Sharing | Who shared a note with whom, when, and whether it was accepted — the full sharing graph. If a note was shared with you, the sender's username is stored on your copy in readable form. For shared payloads we can see which fields were shared (that a title and a body exist), but not their contents. |
| Devices and billing | Your push-notification token, device platform and app version, your subscription tier, and your Stripe customer identifier. |
| Diagnostics | Only if you switch on Share diagnostic logs: event tags, identifiers, counts, and error types. See §3.2. |
We do not operate a server-side search index over your note content (§6.1), and we do not have a mechanism to decrypt the categories covered by §6.1.
7. Data retention
- Active account: We retain your data for as long as your account exists.
- Deleted notes: Soft-deleted notes are queued for permanent deletion and purged from local storage after the auto-clear period you configure (default: 30 days). On the server, deletion propagates on your next sync.
- Account deletion: When you delete your account (via Settings → Account → Delete Account or by contacting us), all your data — notes, folders, images, device tokens, and billing records — is permanently deleted from our servers via a cascading database deletion. This cannot be undone. Allow up to 7 days for all copies to be purged from backup snapshots.
- Inbound email: Because encryption is set up on every current account, email-to-note is disabled — our servers hold no key with which to encrypt incoming mail for you, and the feature refuses to store mail in readable form rather than fall back. On older accounts without encryption, a parsed message is stored as a note and the raw email payload is not retained after parsing.
- Encryption keys are permanent and only yours: because your encryption passphrase and recovery key never reach us, we cannot recover your encrypted notes if you lose both. This is a consequence of the design, not a policy we could waive. The App warns you of this when you set encryption up. Keep your recovery key somewhere safe.
8. Your rights
Depending on where you live, you may have the right to:
- Access a copy of the personal data we hold about you.
- Correct inaccurate data.
- Delete your account and all associated data (see §7 and our account deletion page).
- Export your data at any time using Settings → Backup → Backup all notes (.slote-bundle). This produces a portable archive of all your notes, folders, and images. Note that the archive is not encrypted — anyone who obtains the file can read it, so store it accordingly.
- Withdraw consent where processing is based on consent.
To exercise these rights, email us at support@slote.io. We will respond within 30 days.
9. Children's privacy
Slote is not directed at children under 13 (or the applicable age of digital consent in your jurisdiction). We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will delete it promptly.
10. Third-party links and content
Notes may contain links to external websites. We are not responsible for the privacy practices of those sites. Clicking a link leaves the Slote app environment.
11. Changes to this policy
We may update this policy from time to time. When we do, we will update the "Last updated" date at the top and, for material changes, notify you via the email address on your account. Continued use of the App after a change constitutes acceptance.
12. Contact
If you have questions or concerns about this policy or your data:
Email: support@slote.io
Website: https://slote.io
Mailing address: Not applicable — contact by email only