What is public, what is private, and what you control.

When you place a note, its text and the signature you choose become public immediately — no account required to read, and notes are permanent and may be indexed by search engines. To run the service and keep it free of spam and abuse, we also collect a small amount of account and technical information, described in full below.

We do not sell your personal data, and we do not use your notes to build advertising profiles about you.

Depending on how you use AddYourNote, this may include:

• Email address — used to send your magic sign-in link and, where relevant, to verify ownership of a claimed signature.
• Claimed signature — the verified name that appears on notes you author.
• Username / handle — your public identifier (for example, your profile at /@you).
• Profile information — an optional display name and any optional details you choose to add.
• Notes — the text you publish and the board you publish it to, including where you place and move each note on the canvas.
• Messages you send us — anything you include when you contact us for support or legal requests.

When you visit, some technical information is recorded so the service works and stays secure:

• IP address
• Device information (device type and general capabilities)
• Browser type and version
• Operating system
• Cookies and similar local storage
• Analytics events (pages viewed, basic interactions)
• Session information (whether you are signed in)
• Timestamps for when a note is created or moved

This information is used for operating, securing, and improving the service. It is not displayed publicly next to your note.

We collect data for specific, limited purposes:

• Authentication — to sign you in via magic link and keep your session active.
• Magic-link sign-in — your email is used to deliver a one-time, time-limited sign-in link.
• Verifying signature ownership — to confirm a claimed signature genuinely belongs to you.
• Preventing abuse and spam — IP and device metadata help us rate-limit, detect, and block abuse.
• Improving the product — aggregate analytics tell us what to fix and build next.
• Security — to detect, investigate, and respond to incidents.
• Customer support — to answer your questions and act on your requests.

We use a small number of trusted providers to operate AddYourNote. Each only receives the data needed to perform its function:

• Hosting & CDN (Vercel) — serves the application and delivers content quickly worldwide.
• Database (Neon) — securely stores accounts, signatures, and notes.
• Email provider (Resend) — delivers magic-link and notification emails.
• Analytics (Vercel Analytics) — privacy-friendly, aggregate usage measurement.
• Error monitoring — captures technical errors so we can fix them.

These providers process data on our behalf under their own security and privacy commitments. We do not sell data to anyone.

We use a minimal set of cookies. Essential and authentication cookies keep you signed in and the service secure; functional and analytics cookies help us remember preferences and understand usage.

For the full breakdown and how to switch them off, see our Cookie Policy.

Wherever you live, you can exercise the following. Under laws such as the GDPR and CCPA these are formal rights:

• Access — request a copy of the personal data we hold about you.
• Correct — fix inaccurate profile or account information.
• Delete — ask us to delete your account, notes, and associated data.
• Export — receive your data in a portable format.
• Object & restrict — object to or limit certain processing.
• Withdraw consent — opt out of non-essential cookies and analytics at any time.

To make any request, email privacy@addyournote.com or use our contact form. Note that text you published publicly may persist in search-engine caches outside our control even after removal from AddYourNote.

• Notes — kept while published; removed when you or a moderator delete them.
• Account & signature data — kept while your account exists, then deleted on request.
• Magic links — short-lived and expire automatically after a brief window.
• Moderation metadata (IP, user agent) — retained only as long as needed for abuse prevention, then discarded.
• Analytics — stored in aggregate, not tied to your identity long-term.

Connections are encrypted in transit (HTTPS). Sign-in uses one-time, expiring magic links rather than stored passwords. Access to production data is limited, and we rely on reputable infrastructure providers with strong security practices. No system is perfectly secure, but we work to protect your information and respond promptly to any incident.

AddYourNote is not directed to children under 13 (or the minimum age in your country). We do not knowingly collect data from children. If you believe a child has provided us information, contact us and we will remove it.

As the service grows, this policy may change. We will update the “Last updated” date above and, for material changes, make a reasonable effort to notify you.

For any privacy question or request, email privacy@addyournote.com or visit the Contact & Legal Requests page.