What we collect, and why.

What we collect

Your account. Your email address, an optional display name, and an account ID. Your sign-in password is checked by Firebase Authentication, and we don’t store it.

Your shares. The note, photo or file you share is encrypted on your device before it’s sent, and we store only the encrypted copy. We also store each share’s name, its rules (expiry, number of opens, opening date), timestamps and counts. Share names are not encrypted, so avoid sensitive details in them. To let you see each access password again, we keep a copy protected with a Google Cloud key. This isn’t end-to-end encryption: read who can unlock what.

When someone opens a share. Recipients don’t need an account. If they choose to type their name, we pass it to you in the open alert. We keep short-lived request records to limit repeated attempts.

In the app. A push token, if you turn on open alerts; a random ID for the installation, which the server hashes to limit requests; and the public half of a key kept in your device’s Secure Enclave, used to confirm it’s you before showing saved passwords. Apple’s App Attest and DeviceCheck tell us a request comes from a genuine copy of the app on a real device. They don’t tell us who you are.

Purchases. If you buy Securanote Pro in the app, we receive Apple’s signed record of the purchase so we can unlock Pro on your account. Pro bought on the web is handled by Stripe. We never receive your card details.

What we don’t collect

No advertising, no analytics or tracking tools, and no tracking across other apps or websites. We don’t read your contacts or calendar, and we don’t collect your location. Photos you share are saved again without their location before they’re encrypted. Face ID and Touch ID stay on your device: the app only learns whether the check passed.

We never sell your information.

How we use it

Only to run Securanote: to create and deliver your shares, enforce the rules you set, send open alerts and account emails (such as email verification and password reset), keep your plan’s share allowance, prevent abuse, and help you when you contact support. We don’t look at your shares or saved passwords. The admin dashboard doesn’t show anyone’s content or passwords.

Services that process your information

Google Cloud and Firebase: hosting, database, file storage, sign-in, the key that protects saved passwords, push alerts and app checks. Data is stored in the United States.

Apple: App Store purchases, push notification delivery, App Attest and DeviceCheck.

Stripe: payments made on the web.

Resend: sending our emails. Open alerts never include what you shared, the link or its password.

These services handle information only to provide their service to us, and may process basic technical details such as IP address or device type to work.

How long we keep it

A share’s encrypted content and saved password are kept until it expires, runs out of opens, or you stop sharing it, and are then removed. The share’s record is removed from your list when you delete it, or becomes eligible for removal 24 hours after you stop sharing. Removed data can stay in backups and recovery copies for up to seven days. Your account is kept until you delete it. Records of purchases may be kept longer where the law requires.

Deleting your account, and your choices

You can delete your account and all of its shares at any time: in the app under Account › Delete account, or on the web under Account. You can also email support@securanote.com to ask what we hold about you, to correct it, or to have it deleted. Deletion runs in the background and can take a short while to finish everywhere.

You can turn open alerts off in the app or in your device’s notification settings at any time.

Cookies and storage on your device

The website uses cookies only to keep you signed in and to protect your account. The website doesn’t keep your notes or access passwords in browser storage. The app keeps your sign-in in the iOS Keychain, and a few settings and widget details on your device, such as share names, which you can hide.

Children

Securanote isn’t meant for children under 13, and we don’t knowingly collect their information. If we learn that we have, we’ll delete it.

Changes and questions

If we change this policy, we’ll update the date above, and tell you in the app or by email if the change is significant. Questions are welcome at support@securanote.com.