Privacy Policy

• We don't sell your data to anyone.
• We don't track you as an individual across sites.
• We only collect what's needed to run the site.
• You can delete your account from your account page. For a full data export or scrub of comment text, use our contact form.
• We keep your account anonymous to other users. Only you and we know your email.

To run Public Notes we collect and store:

• Your email — for verification, account recovery, and rare service announcements. Never sold. Never used for marketing.
• Your username — public; appears on your comments.
• Your password hash (bcrypt) or passkey public key. We never see your actual password, and a passkey's private key never leaves your device.
• Your comments and votes — public by design. They're the site.
• IP address — briefly, by our hosting provider, for security and abuse prevention. Not joined to your identity, not retained long-term, not shared.
• Aggregate / broad demographic data — e.g., "X% of traffic comes from the US." We don't profile you individually.

We use exactly two cookies and both are essential:

• Session cookie — set when you sign in so we know who you are on subsequent requests. Cleared when you sign out.
• Theme preference — remembers whether you chose dark or light mode.

No tracking cookies. No third-party cookies. No "essential" cookies that aren't actually essential.

If law enforcement requests user data, we'll comply only with valid legal process (warrants, subpoenas, court orders). We'll push back on overbroad requests when we can. If a gag order doesn't prohibit it, we'll notify the affected user before handing over data. If we're ever served, we plan to publish transparency reports — there's nothing meaningful to report yet.

You can ask us to:

• Show you what we have on you (data access / portability).
• Delete your account and all personal data associated with it (right to be forgotten). Your comments are marked as removed; if you'd like the original text purged too, say so.
• Correct anything wrong in your account.

Send us a message via the contact form using the address on your account so we can verify it. We'll respond within 30 days. You don't need to live in the EU or California to ask — we honor these requests for everyone.

We keep your account data for as long as your account is active. If you delete your account, we delete or anonymize your personal data within 30 days. Short-lived server logs rotate quickly and we don't retain them.

Public Notes is not for users under 13. We don't knowingly collect data from children under 13. If you believe a child has signed up, contact us and we'll delete the account.

The site and our database live in the United States. If you're using it from outside the US, your data crosses borders to get to us. We honor the access, deletion, and correction rights described above regardless of where you live.

We may update this policy. Material changes will be announced on the site. The current version is always at publicnotes.xyz/privacy.

Privacy questions, data requests, complaints: use our contact form.