Our Commitment to Your Privacy
At Squirrel Notes, your privacy isn't just a feature — it's our foundation. We've architected our entire system around zero-knowledge encryption, ensuring that we cannot access your notes even with full database access. This document explains exactly how we handle your data.
What Data We Collect
Account Information
When you create an account, we collect your email address and authentication credentials. This is necessary to identify you and sync your encrypted notes across devices.
Encrypted User Content
We store your notes, collections, tags, and file attachments in encrypted form on our servers. All user-authored content — note bodies, note titles, collection names, tag names, and attachment filenames — is encrypted client-side before transmission. Only structural metadata (IDs, sort order, icon colors, MIME types, file sizes) is stored unencrypted, as it contains no user-authored information.
Usage Information
We collect minimal usage data (like login times and error logs) to maintain service quality and security. This data does not include the content of your notes or any personally identifiable information beyond your email.
How Your Data Is Protected
End-to-End Encryption
All user content is encrypted using AES-256-GCM before leaving your device. The encryption keys are derived from your passphrase using PBKDF2, making brute-force attacks computationally infeasible. Your passphrase never leaves the browser and is never sent to the server.
Zero-Knowledge Architecture
Even with full database access, an attacker cannot read any user content. We use a DEK/KEK key-wrapping system: a random Data Encryption Key is wrapped by a Key Encryption Key derived from your passphrase. This enables passphrase rotation without re-encrypting all data.
Quick Unlock PIN
An optional PIN wraps the DEK so you can unlock without retyping the full passphrase on trusted devices. The PIN does not weaken your encryption — it simply provides convenience without compromising security.
Secure Transmission
All data transmitted between your device and our servers uses TLS encryption, ensuring your encrypted data is protected in transit.
What We Don't Do
- We don't sell your data to third parties. Ever.
- We don't use your note content for advertising or analytics.
- We don't scan or analyze your note content.
- We don't share your data with third parties except as required by law.
- We don't track you across other websites or services.
Data Retention and Deletion
Your encrypted notes are stored on our servers as long as you maintain an active account. You can delete individual notes or your entire account at any time. When you delete data, it is permanently removed from our active systems within 30 days and from backups within 90 days.
Third-Party Services
We use minimal third-party services to operate Squirrel Notes. These include hosting providers and email delivery services. We carefully vet all third-party services to ensure they meet our privacy standards. None of these services have access to your unencrypted note content.
Images from other websites. A note can contain an image hosted on another website. Squirrel Notes doesn't load these by itself: you see a Load external image button, and the first time on each device, a warning. If you choose to load one, your browser requests it directly from that website, which then sees your IP address and when you loaded it. We don't send it the page you were on (no referrer). An image address can itself contain text, including note text if an AI agent or the API wrote it, so load only images you trust. On a public shared note, a visitor's browser contacts another website only if they click Load image. We don't control those websites or their privacy practices.
Your Rights
You have the right to access, correct, or delete your personal information at any time. You can export all your data or delete your account directly from the application settings. For additional requests or questions about your data, please contact us.
Changes to This Policy
We may update this privacy policy from time to time. We will notify you of any material changes by email or through a notice in the application. Your continued use of Squirrel Notes after such changes constitutes acceptance of the updated policy.
Contact Us
If you have questions about this privacy policy or our data practices, please contact us through our contact page or email us directly at hello@squirrelnotes.app.