Privacy policy

Michel Häusermann, 4132 Muttenz, Switzerland. General contact: [email protected]

Privacy contact: [email protected]

• Account data: e-mail address, a hash of your password (never the password itself), the language you chose, the encrypted secret for two-factor authentication, public keys and names of your passkeys, e-mail verification and one-time codes (stored as hashes), and the time of your last login.
• Sessions and devices: device name, IP address of the last access and timestamps for each signed-in browser or Obsidian device.
• Vault data: your notes and files are end-to-end encrypted on your device. The server stores only encrypted content plus technical metadata such as file sizes, timestamps, revision history, vault membership and invitations (including the e-mail address of an invited person). We cannot read the content.
• Subscription data: your plan, the status of your trial or subscription (active, payment failed, cancelled), the end of the paid period, the dates of read-only mode and planned data deletion, and your customer and subscription numbers at Stripe. We do not receive or store your card or bank details; see section 4.
• Usage data: aggregated transfer volumes per account and day, used storage, and technical server metrics (counts, sizes and timings, never content).
• Logs: the server log contains requests with a shortened IP address (last part removed). The audit log records security-relevant admin actions with the account e-mail, action, timestamp and IP address.
• Published notes: if you publish a note by link, anyone with the link can read that copy. We only count views; visitors' addresses are not stored beyond the shortened server log. The page loads nothing from third parties, is kept out of search engines and sends no referrer.
• Registration protection: when you register on the hosted service, a Cloudflare Turnstile check runs to keep out bots; see section 5.
• E-mails: we log every e-mail the server sends (recipient, type, subject, delivered or not, no content). We keep the history of service notices sent to users (content and recipients) for 12 months. We also keep e-mails you send us for as long as needed to answer them.

We use the data to provide and secure the service (account, sign-in, sync, sharing), to handle trials and subscriptions, to send service e-mails (verification, one-time codes, password reset, invitations, storage and billing notices, planned deletion, maintenance and changes to our terms), to detect abuse and errors, to answer enquiries and to meet legal obligations. Service e-mails are not advertising; we send no newsletters or marketing.

Legal bases (GDPR users): performance of the contract (Art. 6(1)(b)), our legitimate interest in security, fraud and abuse prevention and reliable operation (Art. 6(1)(f)), legal obligations (Art. 6(1)(c)). Under the FADP the processing is proportionate, purpose-bound and transparent.

We do not sell your data, do not use it for advertising and do not profile you. We make no decisions based solely on automated processing that have legal effect on you; the automatic switch to read-only mode after the trial or a missed payment is a contractual consequence you can see in advance.

Payments on the hosted service are handled by Stripe (“Managed Payments”), which acts as our merchant of record: Stripe sells the subscription to you (your statement and receipts show “Sold through Link”), collects the payment, calculates and pays VAT or sales tax, issues the invoice and handles payment disputes. Stripe's own terms and privacy notice apply to the payment (stripe.com/privacy). [verify which Stripe company acts as merchant of record for customers of a Swiss provider and name it]

• What we send to Stripe: your e-mail address, an internal account number, the selected plan and, for plan changes or cancellation, the instructions you gave in the app.
• What you enter at Stripe: name, billing address and country, payment method and tax details are collected by Stripe directly in its checkout. We never see card or bank data.
• What Stripe sends back: subscription status, the plan, the end of the paid period, your country (to show the correct price) and payment records (date, amount, status, refunds). We keep only what we need to run your subscription.

For the payment itself, Stripe decides on purposes and means as an independent controller. For managing your subscription in the app, we act as controller and Stripe supports us. Invoices and the customer portal (payment method, plan change, cancellation) are hosted by Stripe and open from the plan page; Stripe also gives you access to your purchases through its Link account.

We use only technically necessary storage in your browser, which needs no consent. We do not use analytics, advertising or tracking cookies.

• websync.sessionToken (local storage): keeps you signed in. Removed on sign-out.
• websync_locale (cookie, 1 year): remembers the language you picked.
• websync.workspace.* and chart settings (local storage): layout and display preferences.
• Offline data (browser storage of the installable web app): notes you opened, stored encrypted, plus your queued offline edits. Signing out removes it.
• cc_cookie (cookie, 6 months): remembers your choice in the consent banner.

Two pages load a script from a provider, so that provider receives your IP address and browser details when the page opens:

• Payment page (/pay): js.stripe.com (Stripe.js). It shows the checkout form. Stripe may set cookies or similar identifiers that are needed for the payment and for fraud prevention.
• Registration: challenges.cloudflare.com (Cloudflare Turnstile). It checks whether the request comes from a person and sends your IP address and technical browser signals to Cloudflare (cloudflare.com/privacypolicy). We use it on the basis of our legitimate interest in keeping out bots.

You can reopen the banner at any time via “Cookie settings” in the footer.

We pass data only to service providers:

• Stripe (Stripe and its group companies, merchant of record): payment and subscription data, see section 4.
• Cloudflare (Turnstile): registration protection, see section 5.
• Hosting: [provider, location of the servers]
• E-mail delivery: [SMTP provider, or delete if not used]

Hosting and e-mail providers process data on our behalf under a contract. Further disclosure happens only if the law requires it or an authority orders it. Data in your vaults is shared only with people you invite to that vault.

Our data is stored in [country of the servers]. Stripe is established in Ireland and the USA and processes data there and in other countries; Cloudflare is established in the USA and operates a global network. If a provider is located in a country without an adequate level of data protection, we rely on safeguards such as the EU standard contractual clauses, or on a certification under the Swiss-US / EU-US Data Privacy Framework ([verify per provider; delete what does not apply]).

• Account and vault data: until you delete your account or vault.
• Trial and subscription: when a trial or paid period ends, the account is read-only for 30 days, then its data is deleted. We remind you by e-mail 7 days before. Deleting the account removes all data at once.
• Published notes: until you unpublish the note or delete the vault or account.
• Signed-in sessions: until sign-out or expiry. Ended and expired sessions, one-time codes, verification links and pending logins are deleted 30 days after they ended or expired.
• IP addresses: in the audit log blanked after 90 days; in a session blanked after 90 days without use.
• Audit log entries: deleted after 12 months.
• Mail log (recipient, type, subject, no content): deleted after 90 days.
• History of service notices (content and recipients): deleted after 12 months.
• Usage data per account and day: while the account exists. Technical server metrics: 14 days.
• Old file versions and deleted files: restorable for 30 days (180 days with the largest plan), then removed.
• Backups: [not decided yet: whether backups of the database and files are made and for how many days, then state that data you deleted disappears from them after that time]
• Payment, invoice and tax records are kept by Stripe as merchant of record for the periods required by law (in Switzerland generally 10 years).

Vault content is end-to-end encrypted; transport uses TLS; passwords are stored hashed; two-factor authentication is supported. No system is perfectly secure. If you lose your vault key we cannot recover your data.

You can request access to your data, correction, deletion, restriction, a copy in a common format, and object to processing based on our legitimate interests. You can withdraw any consent at any time. In the web app under Settings → Your data you can download a copy of your data and delete your account yourself (a running subscription has to be cancelled first). Otherwise write to [email protected]; we may need to verify your identity. For data Stripe holds as an independent controller, you can also contact Stripe.

You may complain to the Swiss Federal Data Protection and Information Commissioner (edoeb.admin.ch) or, if you are in the EU, to your local data protection authority.

The service is not meant for people under 16. If you believe a child has registered, write to us and we will delete the account.

We may update this policy. The current version is always published on this page.