Privacy Policy
Effective date: 2026-06-11
Last updated: 2026-08-17
1. Who we are
Slote ("we", "us", "our") is a note-taking application developed and operated by Cheah Bing Wen, an individual developer ("Developer"). You can reach us at:
- Email: support@slote.io
- Website: https://slote.io
2. What this policy covers
This policy describes how Slote collects, uses, stores, and shares information when you use the Slote mobile and desktop application ("the App"). It applies to all platforms on which Slote is available (iOS, Android, Windows, macOS).
It also covers one thing that happens outside the App. Before Slote launches, our website offers a waitlist; if you join it, this policy describes what we do with the email address you give us (§3.4). Web is not a supported Slote platform — there is no version of Slote you use in a browser — and nothing in this policy describes one.
3. Information we collect
3.1 Information you provide directly
| Data | Why we collect it |
|---|---|
| Email address | Account creation, sign-in, password reset, and the inbound email-to-note address (<alias>@inbound.slote.app). |
| Username / display name | Shown in note-sharing attribution ("Shared by @username"). |
| Note content | Text, headings, lists, tables, and other rich-text blocks you write in Slote. Stored locally and, when you are signed in, synced to our servers. If you have set up an encryption passphrase, it is encrypted on your device before upload; if you have not, it is stored in readable form on our servers. See §6.1 — this distinction matters. |
| Drawing data | Ink strokes you make on notes. Stored and synced alongside note content, and encrypted on the same terms (§6.1). |
| Images | Photos or images you explicitly paste or pick into a note. Stored locally; uploaded to our servers when signed in, and encrypted on the same terms (§6.1). |
| Profile photo | If you choose to set one, uploaded to our servers (stored privately; not end-to-end encrypted — low sensitivity, used for cross-device display). |
3.2 Information collected automatically
| Data | Why we collect it |
|---|---|
| Device push token | A Firebase Cloud Messaging (FCM) registration token stored per device. Used exclusively to route push notifications for note-sharing events to your device. |
| App platform and version | Recorded when registering a device for push notifications so we can route FCM payloads correctly per platform. Not transmitted to any analytics service. |
| Sync metadata | Timestamps (created_at, updated_at, sync_status) attached to your notes and folders so multiple devices stay in sync. See §6.3 for the full list of what our servers can see. |
| In-app diagnostic logs | Written to a local database on your device. They are uploaded to our servers only while Settings → Diagnostics → Share diagnostic logs is switched on, which is off by default. They record event tags, identifiers, counts, and error types — not the content of your notes. |
| Crash reports | The App can send crash and error reports to Sentry (see §5). This is controlled by a build-time setting rather than an in-app toggle, and is not enabled in current builds — no crash data is being sent today. If we enable it, reports will contain the error, a stack trace, the app version, and an opaque account identifier; they are configured never to include your email address or note content. We will update this policy's "Last updated" date when that changes. |
3.3 Payment information
Billing is handled entirely by Stripe. When you upgrade to Slote Pro, you enter payment details directly on Stripe's interface. We receive only a subscription status indicator (free / pro) and a Stripe customer ID. We never see or store your card number, CVV, or billing address.
3.4 Waitlist signups on our website
Joining the waitlist is optional and separate from having a Slote account. You do not need an account to join, and joining does not create one.
| Data | Why we collect it |
|---|---|
| Email address | The address you type into the waitlist form. We use it to send you a welcome email straight away and one announcement when Slote launches. Nothing else is sent to it. |
| Which form you used | A short label recording whether you signed up from our home page or our waitlist page, so we can see which page brings people in. |
| When you joined | Recorded on your entry and used to order the list. |
| When you unsubscribed | Recorded if you leave the list, so that a later mailing cannot reach you again. |
| A one-way hash of your IP address | Used to cap how many welcome emails one internet connection can trigger in an hour, so the form cannot be used to send mail to people who did not ask for it. Your IP address itself is not stored. Our server converts it into an irreversible SHA-256 hash and writes only that hash, as the label on a counter; those counters are deleted after a day. Our website host also sees your IP address while handling the request, as any web server does, and keeps it briefly in its own logs (§5). |
We also count how many people are on the list, so our website can show that total. The count is a single number and exposes no address.
How your consent works, and what it does not include. Entering your address and pressing the button is the consent. We send the welcome email immediately and do not ask you to confirm the address by clicking a link first. Two consequences are worth stating plainly. Anyone who types your address into our form can put it on our list, and we have no way to tell that it was not you. And an address entered with a typo stays on the list until mail to it bounces. If a waitlist email reaches you that you did not ask for, the unsubscribe link in it will work whether or not you signed up.
Leaving the list. Every waitlist email carries an unsubscribe link, and mail apps that support one-click unsubscribe will offer their own button next to the sender. Either one stops all further email. Neither one deletes your entry: we keep the address, marked as unsubscribed, precisely so that a later mailing cannot reach you by mistake. To have the entry itself removed, email support@slote.io and ask (§7, §8).
Where it lives. The waitlist is held in a Supabase project entirely separate from the one holding Slote accounts and notes, with no link between them — nothing in the waitlist can reach a Slote account, and nothing in the App can reach the waitlist. The emails are sent through Resend (§5).
3.5 Information we do NOT collect
- We do not collect precise or coarse location data.
- We do not collect contacts.
- We do not use any advertising SDKs or cross-app tracking.
- We do not sell or rent your data to any third party.
4. How we use your information
- Providing the service — syncing your notes across devices, sending push notifications when someone shares a note with you, enabling you to export and import notes.
- Account management — authentication, session restoration, account deletion.
- Billing — checking your plan tier to apply the storage and device limits for that plan; processing subscription events via Stripe webhooks.
- Security and abuse prevention — server-side rate limiting and RLS (Row-Level Security) policies that ensure you can only access your own data.
- Customer support — if you contact us, we may use your email and the information you provide to respond.
- The launch waitlist — sending the welcome email that confirms your address is on the list, sending the announcement when Slote launches, showing on our website how many people have joined, and rate-limiting the form so it cannot be used to send email to people who did not ask for it (§3.4).
5. How we share your information
We share data only with the service providers listed below, all of which are contractually bound to process data only as directed.
| Provider | What they receive | Purpose | Privacy policy |
|---|---|---|---|
| Supabase (Slote accounts and notes) | Account data, your notes and folders (as ciphertext where §6.1 applies, otherwise readable), images, shared-note payloads, and the server-readable metadata listed in §6.3 | Database, authentication, object storage, Edge Functions | supabase.com/privacy |
| Cloudflare (R2) | PDF files you import into notes, stored as encrypted objects in a private bucket | PDF file storage | cloudflare.com/privacypolicy |
| Google / Firebase | Device push token, notification payloads | Push notification delivery | policies.google.com/privacy |
| Supabase (website waitlist — a separate project) | If you join our waitlist: your email address, which form you used, when you joined, when you unsubscribed if you do, and the one-way IP hash described in §3.4. No account data and no note data of any kind | Database for the waitlist | supabase.com/privacy |
| Resend | The email we send you and the address it goes to: account email such as sign-up confirmation and password reset, and — if you joined the waitlist — the waitlist welcome and launch emails | Sending our email | resend.com/legal/privacy-policy |
| Vercel | Our website host. Every request to our website passes through them, including the IP address your browser connects from, which they keep briefly in their request logs. They also record aggregate page-view statistics for our website — the page, the referring site, an approximate location, and your browser and device type — without cookies and without anything that identifies you individually | Website hosting and website analytics | vercel.com/legal/privacy-policy |
| Stripe | Subscription events (no card data from us) | Billing and subscription management | stripe.com/privacy |
| Sentry (not currently enabled) | Crash and error reports: error type, stack trace, app version, opaque account identifier. Configured to exclude email addresses and note content. See §3.2 | Crash and error reporting | sentry.io/privacy |
| SendGrid (optional) | Inbound email bodies sent to your alias | Email-to-note inbound parsing | sendgrid.com/policies/privacy |
Where a row above says data is encrypted, the encryption key is derived on your device from your encryption passphrase and is not transmitted to us or to the provider — so the provider stores bytes that neither they nor we hold a key for (§6.1).
We do not share your data with anyone else unless required by law.
6. Security and encryption
6.1 How encryption works
Encryption is not optional for synced notes. The first time you sign in, Slote requires you to create an encryption passphrase, and you cannot reach your notes in the App until your encryption is unlocked. Everything you sync from that point on is encrypted on your device before it is uploaded.
The mechanism. Your encryption passphrase is separate from your login password; resetting your login password does not affect it, and we never receive the encryption passphrase. Your device uses it to derive a key with Argon2id (a deliberately slow, memory-intensive function, which makes guessing the passphrase expensive). That derived key protects a randomly generated account key. Each time a note is uploaded, your device generates a fresh key for that upload, encrypts the content with AES-256-GCM, and encrypts that per-note key under your account key.
What our servers receive is the encrypted bytes, plus copies of your keys that are themselves encrypted under keys we do not have. Your passphrase, the key derived from it, and your unencrypted account key never leave your device. We therefore do not hold a key that decrypts this content, and neither does Supabase nor Cloudflare.
This describes how the current version of the App works. It is not a promise about future versions — the App is what performs the encryption, so a future release could in principle behave differently. If we change this, we will change this policy and say so.
Your recovery key. When you set up encryption, Slote shows you a recovery key once. It is a second, independent way to unlock the same account key. We never receive it. If you lose both your passphrase and your recovery key, your encrypted notes cannot be recovered — not by you and not by us. There is no reset we can perform, because we hold nothing that would let us do it. Please store the recovery key somewhere safe.
Notes from earlier versions. Notes that synced before encryption existed in Slote may still be stored in readable form on our servers until they are migrated. The App can re-encrypt them (Settings → Encryption → Encrypt existing data). Until that runs for a given note, we are technically able to read it.
What encryption covers: note titles, note body text, ink drawings, text boxes, page-layout data, images you add to notes, PDFs you import, and the payloads of notes you share with another Slote user. Shared payloads are sealed to the recipient's public key using X25519 key agreement, so we do not hold a key for those either. When a note is shared with you, the App decrypts it on your device — our servers never do.
What encryption does not cover: see §6.3. In short, encryption protects the contents of your notes, not the facts about them — folder names, timestamps, sizes, and who you share with remain readable to us.
PDFs. PDFs you import are encrypted on your device and stored as encrypted objects in a private Cloudflare R2 bucket, under a path derived from your account and note identifiers; the original filename is not used. PDFs imported by earlier versions may still sit in our older storage bucket, which is private and access-controlled but not end-to-end encrypted.
Search runs entirely on your device against a local index. We do not operate a server-side index of your note content, and the text used for searching is never uploaded.
On your own device, notes are stored unencrypted in the App's private, sandboxed database and files. Your device's own disk encryption and app sandboxing protect them there. Your encryption key is held in your device's secure storage (iOS/macOS Keychain, Android Keystore, or the system credential store on Windows) only if you choose to trust that device, and that stored copy expires after 15 days. Backups you export with Backup all notes (.slote-bundle) are not encrypted — treat an exported bundle as readable by anyone who obtains the file.
6.2 Storage and credentials
- Local storage: Your notes are stored in a SQLite database on your device under the app's private container. Images are stored in the app's documents directory. Neither is accessible to other apps.
- Cloud storage: Synced data is stored on Supabase infrastructure (PostgreSQL database and object storage), and imported PDFs on Cloudflare R2. All connections use TLS. Storage buckets are private, and database access rules ensure no user can read another user's data. Note content is additionally encrypted on your device (§6.1).
- Credentials: Sign-in session tokens are stored in your device's secure storage (iOS Keychain / Android Keystore / system credential manager on desktop). Your login password is never stored by us — authentication is handled by Supabase Auth, which stores only a hash. Your encryption passphrase and recovery key are separate from your login password and are never transmitted to us.
- Server regions: The Supabase project holding Slote accounts and notes runs in Northeast Asia (Tokyo) (
ap-northeast-1). The separate Supabase project holding the website waitlist (§3.4) runs in Southeast Asia (Singapore) (ap-southeast-1). Cloudflare R2 distributes objects across its own network rather than a single named region. We are based in Singapore, so your Slote account and note data is stored outside Singapore; §5 lists who holds it and on what terms.
No system is perfectly secure. In the event of a data breach that affects your personal information, we will notify you as required by applicable law. Content encrypted under §6.1 would be exposed only as ciphertext, which is not readable without your passphrase or recovery key; the information listed in §6.3 would be exposed in readable form.
6.3 What our servers can see
Encryption protects what is inside your notes. It does not hide the information our servers need in order to store, sync, and bill for them. We think you should be able to see that list rather than infer it, so here it is in full.
| Category | Readable to us |
|---|---|
| Account | Your email address, username, display name, profile photo, inbound email alias, and chosen accent colour. |
| Note records | That a note exists, its identifier, which account owns it, when it was created, last changed, and deleted; which folder it is in; whether it is pinned, archived, or in the trash; its position in your ordering; and its title font. |
| Folders | Folder names in readable form, along with the full folder tree — which folders exist and how they nest. Folder names are not encrypted. If you would not want a folder name read, do not put sensitive information in it. |
| Files | For each image: its file type, byte size, and storage path. For each PDF: its page count, byte size, and storage location. The file contents themselves are encrypted; their sizes are not, and size can hint at content. |
| Sharing | Who shared a note with whom, when, and whether it was accepted — the full sharing graph. If a note was shared with you, the sender's username is stored on your copy in readable form. For shared payloads we can see which fields were shared (that a title and a body exist), but not their contents. |
| Devices and billing | Your push-notification token, device platform and app version, your subscription tier, and your Stripe customer identifier. |
| Diagnostics | Only if you switch on Share diagnostic logs: event tags, identifiers, counts, and error types. See §3.2. |
We do not operate a server-side search index over your note content (§6.1), and we do not have a mechanism to decrypt the categories covered by §6.1.
7. Data retention
- Active account: We retain your data for as long as your account exists.
- Deleted notes: Soft-deleted notes are queued for permanent deletion and purged from local storage after the auto-clear period you configure (default: 30 days). On the server, deletion propagates on your next sync.
- Account deletion: When you delete your account (via Settings → Account → Delete Account or by contacting us), all your data — notes, folders, images, device tokens, and billing records — is permanently deleted from our servers via a cascading database deletion. This cannot be undone. Allow up to 7 days for all copies to be purged from backup snapshots.
- Inbound email: Because encryption is set up on every current account, email-to-note is disabled — our servers hold no key with which to encrypt incoming mail for you, and the feature refuses to store mail in readable form rather than fall back. On older accounts without encryption, a parsed message is stored as a note and the raw email payload is not retained after parsing.
- Waitlist entries: We keep your waitlist entry until you ask us to delete it. Unsubscribing is not deletion — it stops the email, and we keep the address marked as unsubscribed so that a later mailing cannot reach you by mistake. To have the entry removed, email support@slote.io. Nothing in the waitlist is linked to a Slote account, so deleting your account does not take you off the waitlist, and unsubscribing from the waitlist does not touch your account.
- Waitlist rate-limit counters: The hashed-IP counters described in §3.4 are deleted automatically after a day.
- Encryption keys are permanent and only yours: because your encryption passphrase and recovery key never reach us, we cannot recover your encrypted notes if you lose both. This is a consequence of the design, not a policy we could waive. The App warns you of this when you set encryption up. Keep your recovery key somewhere safe.
8. Your rights
Depending on where you live, you may have the right to:
- Access a copy of the personal data we hold about you.
- Correct inaccurate data.
- Delete your account and all associated data (see §7 and our account deletion page).
- Export your data at any time using Settings → Backup → Backup all notes (.slote-bundle). This produces a portable archive of all your notes, folders, and images. Note that the archive is not encrypted — anyone who obtains the file can read it, so store it accordingly.
- Withdraw consent where processing is based on consent.
To exercise these rights, email us at support@slote.io. We will respond within 30 days.
These rights cover your waitlist entry too, even if you have never had a Slote account. Write to support@slote.io and we will tell you whether an address is on the list, correct it, or delete it, and you do not have to say why. The unsubscribe link in any waitlist email is the fastest way to stop the email, but it does not delete the entry (§7).
9. Children's privacy
Slote is not directed at children under 13 (or the applicable age of digital consent in your jurisdiction). We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will delete it promptly.
10. Third-party links and content
Notes may contain links to external websites. We are not responsible for the privacy practices of those sites. Clicking a link leaves the Slote app environment.
11. Changes to this policy
We may update this policy from time to time. When we do, we will update the "Last updated" date at the top and, for material changes, notify you via the email address on your account. Continued use of the App after a change constitutes acceptance.
12. Contact
If you have questions or concerns about this policy or your data:
Email: support@slote.io
Website: https://slote.io
Mailing address: Not applicable — contact by email only