Privacy Policy
DropNote is engineered to store as little data as technically feasible. We believe privacy policies should be concise, candid, and devoid of legal obfuscation.
1. What We Never Store
- Plaintext Note Content: Notes are encrypted client-side using AES-256-GCM before transmission.
- Decryption Keys: The primary decryption secret resides solely within the URL fragment (
#...) and is never sent to the server. - Passwords: Passwords are processed through PBKDF2 with 100,000 iterations in the client browser. The server never receives your plaintext password.
- Note Titles in Guest Mode: The optional note title is stored strictly in your browser’s IndexedDB and is never transmitted to our servers.
- Third-Party Tracking Pixels or Ad Scripts: No Google Analytics, no Facebook Pixels, no commercial ad networks.
2. What We Store Server-Side
To operate the relay service, our database retains:
- Encrypted ciphertext blob (Base64URL)
- Initialization vector (IV) and cryptographic salt
- Cryptographic envelope version identifier
- Note creation timestamp and expiration timestamp
- View count and maximum view constraint
- Burn-after-reading boolean status
- SHA-256 hash of creator’s deletion token
3. Operational Metadata & Rate Limiting
To prevent automated abuse, denial of service attacks, and brute-force password cracking, client IP addresses are temporarily evaluated in server memory against sliding window rate limits. IP addresses are not permanently recorded in user account profiles or tied to note content.
4. Guest Mode vs Account Mode
Guest Mode: Note management records and deletion tokens are held locally in your browser’s IndexedDB. Clearing browser site data removes management capability.
Account Mode: If you register an account, your user ID associates with note metadata so you can view your notes across devices. Account mode maintains identical zero-knowledge cryptography; note ciphertexts remain strictly unreadable by the server.
5. Deletion Guarantees & Hardware Realities
When a note expires, burns, or is manually destroyed, the database zeroes out the ciphertext and flags the record destroyed. While DropNote immediately purges the active record, we acknowledge the technical reality that cloud backups, ephemeral operating system caches, or physical drive flash sectors may retain fragmented data until naturally overwritten by underlying cloud providers.