What Noteheld stores
Note text is stored in the clear. "We" means Noteheld. A workspace is the notes and folders one master key opens.
This version takes effect on 2026-10-23. The first version took effect on 2026-10-21. If this page and the terms disagree, the terms win.
1. Note text is stored in the clear
Notes are stored on the server as plaintext so the product can search, outline and edit by line. Version 1 does not encrypt note bodies end to end.
The operator of the server can read note text. Noteheld does not send note text to a model, an analytics product, an advertising network, or a font host. If secret scanning is set to warn, the secret is stored in the note. The detector list is finite.
2. Who operates Noteheld
Noteheld operates Noteheld at noteheld.com. Noteheld is built and run by an independent developer in California. Governing law is the State of California. Contact: [email protected].
3. No accounts
No accounts and no third-party fonts in Version 1. Analytics runs on the public pages only; section 13 says what it collects.
Creating a workspace does not ask for a name or an email. You see a new master key once. We store a SHA-256 hash of it, not the key. We do not store the recovery kit. It is a file on your machine that contains the master key. Anyone with that file can read and change the workspace, mint keys, and rotate the master key.
Google sign-in is not available.
Checkout does not ask for an email. PayPal collects the payer's email on its own page. Checkout does not send note text to PayPal.
If you use the contact form or the abuse form, you may type an email so we can reply. Abuse reports are kept for 180 days. Contact-form messages are kept for 90 days.
The light or dark theme stays in this browser under the name nh-theme. It is not a cookie. It is not sent to the server.
4. What we store
We store the workspace id, the plan, settings, and the time of the last authenticated read or write. We store notes, folders, revisions, summaries, and corrections. We store SHA-256 hashes of API keys and view-link secrets, a short display prefix, and the label you set. We store a SHA-256 hash of the session id. We store the public key for a passkey.
The live database files are plaintext. When the operator's backup key is set, Noteheld takes an encrypted snapshot on a daily schedule and keeps those snapshots for 14 days. A snapshot is a copy of the notes. Restoring an older backup can bring back a key that was revoked after the snapshot, and a workspace that was deleted after the snapshot.
5. Network addresses
Network addresses are processed for rate limits and abuse reports. The address is stored as an HMAC-SHA-256 hash with a salt that rotates every 24 hours. The previous salt is kept through one overlap. The raw address is not written to the database. An old hash stops matching new visits after the salt rotates out. Rate-limit snapshots are deleted after 48 hours. Suspension does not pause the Free idle schedule. Paid workspaces never idle-expire.
6. The session cookie
After you paste a key or use a passkey, the browser holds one session cookie for this host. The value is a random id. It is not the master key. The cookie is HttpOnly and Secure, and it is not a tracking cookie. It stays active for 14 days after the last use. It ends 30 days after it starts, even if you keep using it. Revoking the key drops sessions tied to that key.
A passkey can sign you in and rotate the master key. If the master key, the recovery kit and the passkey are all gone, we cannot recover the workspace.
7. How long notes stay
Deletes are soft until the workspace is deleted.
On the free plan, full history lasts 30 days, then one checkpoint per note per day, the latest revision that day, for 365 days. The current text is always kept.
A free workspace with no authenticated read or write warns on day 60, becomes read-only on day 90, and is deleted on day 120. Writes stop. View links stop. A view-link visit does not reset that clock. The master key can reactivate it before the purge, and the idle count starts over.
Pro keeps every revision. A write past the storage cap fails and deletes nothing. Downgrade to Free does not delete notes. The idle clock starts when the workspace moves to Free. If the workspace is over the Free cap, you can still read it and export it. A change that does not grow the workspace still works. A write that would grow it fails.
The change feed keeps events for 14 days on Free and 180 days on Pro.
You can download the current tree as markdown on every plan, including while a free workspace is read-only and after a downgrade. Pro adds a revision archive.
Deleting the workspace removes notes, history, keys, and view links. This cannot be restored.
8. Who else can read the notes
A view link lets someone read a note or a folder with no key. View links are part of Pro. You can choose no expiry. A view link with no expiry works until you revoke it. It is not a safer link.
Marking stored notes as data does not stop a model from following text inside a note.
9. Age
You must be at least 13 years old. United States law restricts collecting personal information from children under 13, and this service is not for them. There is no account, so we do not ask your age and we cannot check it. Do not use Noteheld if you are under 13. If the place where you live requires an older age to use an online service, you must be that old. We do not knowingly collect personal information from a child under 13. If we learn a workspace was opened by someone under 13, we suspend it and then delete it with its notes.
10. Who decides, and who else handles data
Noteheld is the controller for site data: the session cookie, network-address hashes, contact messages, and abuse reports. Noteheld is a processor for the note text you store. You choose that text. We host it to run Noteheld. The operator of the server can read note text.
No hosting company is named on this page. No email sender is named. The only analytics vendor is Google, in section 13. Noteheld does not send note text to a model, an analytics product, an advertising network, or a font host. The only payment company named here is PayPal, in section 3. PayPal does not receive note text. If another company holds the disks, ask [email protected] for the current list.
We do not publish where the servers are. The operator is in the United States. Version 1 does not include more than one region.
11. California
We do not sell personal information. We do not give personal information to other companies so they can advertise to you on other sites. You can ask what personal information we hold about you, ask us to correct it, or ask us to delete it. We will not charge you a different price for asking. Email [email protected]. There is no account, so an email alone may not match a workspace. For a request about notes, include the workspace id. We may ask you to show that you hold the master key before we change notes. You can export the current tree yourself. You can delete a workspace that is not suspended.
Personal information this service can hold is an email you choose to type on the contact form or the abuse form; a hash of a network address; the workspace id, the plan, and settings; the notes you store; and, on the public pages, what Google Analytics collects (section 13).
12. If you are in the European Union
The operator is in the United States. We do not publish where the servers are. We have not named a representative in the European Union. We do not state a cross-border transfer contract on this page.
We host note text because you asked us to run the workspace. We use the session cookie, address hashes, and abuse reports to run and protect the service. We use a message you send so we can read it and reply, and then we delete it on the schedule in section 3. PayPal takes the payment on its own page. We do not store a billing email.
You can ask us to tell you what personal information we hold, to correct it, to delete it, to limit how we use it, to give you a copy, or to object when a use is not required to provide the service you asked for. You can complain to a privacy regulator in the place where you live. Email [email protected]. Include the workspace id for a request about notes. We may ask you to show that you hold the master key. We do not promise a reply time. Export of the current tree is a copy of current notes you can take on every plan.
13. Analytics on the public pages
The public pages (home, pricing, docs, the legal pages and the like) use Google Analytics, from Google LLC. It counts visits and shows which pages people read and where they came from.
It does not run inside a workspace, on a view link, on a claim link, on the pages that create or open a workspace, or on the contact form. The script is not on those pages, and their security policy does not allow Google.
It does not run for visitors in the European Economic Area, the United Kingdom or Switzerland. The page asks this site which country the connection comes from, and loads nothing when the answer is one of those, or unknown.
Where it runs, Google sets cookies named _ga and _ga_<id> on this site, which last up to two years. It receives the page address, the page you came from, your browser and device type, and your network address, which Google uses for an approximate location. Google signals and ad personalisation are off. Note text and keys are never sent. Google keeps this data for 2 months.
To stop it, block the script or the cookies in your browser, or use Google's opt-out add-on. The site works the same either way.
14. Changes to this page
There is no email list to announce a change. The new version is posted on this page with its new effective date, and a changelog entry records it.
Privacy questions: [email protected]
Abuse reports: [email protected], or the contact form with Abuse chosen.
Security reports: [email protected], described on the security page.