Privacy Policy
Effective 28 October 2026. Version 1.0. The English version is the binding one.
1. Controller
The controller is the company named at the end of this policy. Contact for anything in this policy: support@hushjot.com.
2. The short version
We hold your email address so you can sign in, the encrypted bytes of your notes so they can sync, and a record of your subscription so we know to let you sync. We cannot read your notes. We run no analytics and set no cookies of our own.
3. If you use the App without an account
Nothing leaves your browser except the request for the App’s own files. We receive the ordinary web-server logs for that request (IP address, browser type, time), kept by our hosting provider for a short period for security and capacity, and nothing else. Your notes are stored only on your device, so we hold no copy of them: if your browser deletes its storage, they are gone unless you exported them.
4. What we hold if you have an account
| Data | Why | Kept |
|---|---|---|
| Email address, a hashed password, an account id, sign-in times | To sign you in and to reach you about your account, including the two notices sent before synced notes are deleted (contract) | Until you delete the account |
| Your notes, folders and versions, as ciphertext, with per-item timestamps and revision numbers | To sync them between your devices (contract) | Until you delete them or the account; versions expire after 30 days; everything synced by an account with no active subscription is kept for at least 90 days after the subscription ended and may be deleted at any time after that, with two emails beforehand |
| Your sealed key record (encrypted key material, salts, algorithm parameters) | So a new device can unlock with your passphrase (contract) | Until you delete the account, or until the deletion of an unpaid account’s synced data described above |
| Notes you publish by link, as ciphertext, with an expiry | To serve the link (contract) | Until expiry or revocation, at most 30 days |
| A usage record: the encrypted size of what you have synced, and this month’s counts of uploaded history, published links and sync uploads | To apply the storage and monthly limits in the terms and show you your usage (contract), and to keep the service within its capacity and spot use far beyond normal, which may mean contacting you about it (legitimate interest) | Until you delete the account |
| A record of which version of the terms and of this policy you agreed to, when, and whether at sign-up or at checkout | To be able to show what you agreed to (legal obligation and legitimate interest) | Until you delete the account |
| Subscription status, plan, period end, and Paddle’s customer and subscription identifiers | To know whether to allow sync (contract), and for our accounts (legal obligation) | As long as Portuguese tax law requires (currently 10 years), with the account identifier removed after account deletion |
| Backups of the above (ciphertext and account records, as stored, including the sign-in records: email addresses and hashed passwords) | To recover the service after a defect, an attack or an infrastructure failure (legitimate interest) | Up to 60 days, then deleted automatically. Data you delete, or that is deleted after a subscription ends, can remain in backups until then; we do not restore it except to recover the whole service, and then delete it again |
| Emails you send us | To answer them (legitimate interest) | Up to 2 years |
What we never hold: your vault passphrase, your recovery code, any decryption key, or the readable text of a note, a title or a folder name. Our servers receive only ciphertext. The security page lists exactly which fields are readable (timestamps, sizes, counts) and why.
The command-line tool and AI agents. If you use the hushjot command-line tool or connect an AI agent to it, your notes are decrypted on your own computer. Anything an agent reads is sent to that agent’s provider under its terms; it never passes through us and we cannot see it.
Payment card details are collected and held by Paddle, never by us. We see that a payment succeeded or failed, the amount, and the country used for tax.
5. Who processes it for us
| Processor | What | Where |
|---|---|---|
| Google Cloud / Firebase (Google LLC and Google Ireland Ltd) | Authentication, encrypted note storage (Cloud Firestore), and hosting of the App and this site | Data stored in the United States (us-central1), with a backup copy in a separate project, also in the United States (US multi-region); transfers under Google’s Data Processing Terms, the EU–US Data Privacy Framework and standard contractual clauses |
| Paddle.com Market Ltd (UK) and Paddle.com Inc (US) | Merchant of record: checkout, payment, tax, invoices, refunds, the customer portal. Paddle is an independent controller for the purchase; see Paddle’s privacy policy | United Kingdom and United States |
| Fly.io, Inc. | The billing service that receives Paddle’s payment notifications and keeps our subscription records | Frankfurt, Germany, on servers operated by a US company under standard contractual clauses |
| Cloudflare, Inc. | DNS for our domains, and routing of the email you send to [email protected] to our inbox. It handles your email address and the message in transit | Global network, under Cloudflare’s Data Processing Addendum, the EU–US Data Privacy Framework and standard contractual clauses |
| Postmark (ActiveCampaign, LLC) | Delivery of the emails we send about your account: the two notices before synced notes of an unpaid account are deleted, and the confirmation afterwards. It receives your email address and the text of the message | United States, under standard contractual clauses |
Nobody else. We do not sell or share personal data with advertisers or data brokers, and there are no advertising or analytics scripts on the App or on this site.
6. Cookies and browser storage
This website sets no cookies and loads no analytics. Our hosting provider records each request to it (IP address, browser type, page, referring site, time); we use these logs to keep the site secure and to count visits to each page in aggregate (legitimate interest), and they are deleted after 30 days. The App keeps your notes and sign-in session in your browser’s own storage on your device, which is necessary for it to work and is under your control. Paddle’s checkout, shown on the account page, sets its own cookies for fraud prevention and to complete the purchase; see the cookie statement.
7. Emails from us
Only about your account: verification, password reset, receipts (from Paddle), and notices we are required to send, such as changes to terms or prices. No newsletter unless you separately ask for one.
8. Your rights
Under the GDPR and equivalent laws you may ask for access to your data, correction, deletion, restriction, a portable copy, and to object to processing based on legitimate interest. In practice: portability is the Export button in the App, which gives you every note as plain Markdown; deletion is described on the support page and is completed within 30 days; everything else is an email to support@hushjot.com. You may also complain to your data protection authority; ours is Portugal’s Comissão Nacional de Proteção de Dados (CNPD).
9. Children
HushJot is not directed at children and accounts may not be created by anyone under 16.
10. Security
The security page is the detailed statement. In short: notes are encrypted on your device with AES-256-GCM under a key only you can unwrap; the server-side rules isolate every account and refuse deletes of history; the App loads no third-party code; and a new version of the App cannot activate without your consent. A breach that affects your personal data will be notified to you and to the authority as the law requires.
11. Changes
We will announce material changes to this policy by email to account holders. The date and version at the top identify the current one.
NEBULOSA D’IDEIAS UNIPESSOAL LDA
Registered in Portugal.