Who we are
Sidenote is an open-source notes app maintained by Abhijith Warrier, an individual developer (referred to as “we”, “us” or “the operator”). This policy covers the project website at awbuilds.github.io/sidenote and the hosted app at sidenoteapp.vercel.app.
It does not cover a self-hosted deployment run by someone else. If you use a Sidenote deployment operated by another person or organisation, that operator is the controller for the data on their server and their privacy policy applies.
The short version
The short version. The hosted app stores your notes in your browser, not on a server. We have no account system, no analytics, no advertising and no cookies. The only server-side processing is standard request logging by our hosting providers.
This website
The website is a set of static pages hosted on GitHub Pages. It has no forms, no login, no comments and no newsletter. It does not set cookies and does not load analytics or third-party scripts.
GitHub, as the hosting provider, may process standard technical data when it serves a page — such as your IP address, user agent, the requested URL and the time of the request — to deliver the page and protect the service. We do not receive that data in a form that identifies you, and we do not combine it with anything else. GitHub's handling is described in the GitHub Privacy Statement.
The hosted app
The hosted app is a static Next.js application served by Vercel. It has no account system and no sync backend. When you write a note, it is stored in your browser's IndexedDB on your device. It is not uploaded to us, and we cannot read it.
The app does not include analytics, advertising, crash reporting, session recording, heatmaps or AI features. It does not load fonts, scripts or images from third-party domains at runtime; its assets are served from the same origin. Vercel may process standard request logs (IP address, user agent, requested URL, timestamp) for delivery, security and abuse prevention, under the Vercel Privacy Policy. We do not use those logs to build profiles.
If you export a ZIP, Markdown, HTML or PDF, the file is created on your device and saved wherever you choose. Printing uses your browser's print dialog. None of it passes through us.
Optional sync and self-hosting
Sync is optional and is not enabled on the hosted app. It exists only
when a deployment is configured with its own Supabase instance (the two
NEXT_PUBLIC_SUPABASE_* variables). In that case:
- the person or organisation running the deployment is the controller of the synced data, not the Sidenote project;
- signing in creates an account on that Supabase instance, and notes, notebooks, tags and attachment bytes are stored there so they can reach your other devices;
- the operator of that deployment is responsible for its privacy policy, retention, access controls and lawful basis.
If you self-host Sidenote for other people, you must publish your own privacy notice and handle their data in line with the law that applies to you.
Share links
Share links are available only on a deployment with a backend. When you create one, the note is served from that deployment's Supabase instance to anyone who has the URL. A password and an expiry date are optional, and the link can be revoked.
You choose what to share. Do not create a public link to a note containing information you do not want to leave your control. The operator of the deployment — not the Sidenote project — is responsible for the shared copy.
Cookies and browser storage
We do not set cookies. The site and app use browser storage that is strictly necessary for them to work:
- localStorage — two small values remembering your theme and theme pack, so the page does not flash the wrong colours before it loads;
- sessionStorage — one flag remembering that the companion already crossed the screen in this tab, so it does not repeat;
- IndexedDB — your notebooks, notes, tags, attachments, version history and settings, stored on your device;
- Cache Storage — the app shell cached by the service worker so the app can start offline.
None of this is used for advertising, profiling or cross-site tracking, and none of it is sent to us. Because it is strictly necessary, no consent banner is shown. The cookie policy explains how to clear it.
Why we process data
Where the EU or UK GDPR applies, we rely on the following bases:
| Processing | Basis |
|---|---|
| Standard request logs kept by GitHub Pages or Vercel to deliver and protect the site | Legitimate interests (Art. 6(1)(f)) — running a secure, available service |
| Notes and settings stored in your browser | Not processing by us: the data stays on your device under your control |
| Optional sync and share links on a self-hosted deployment | Chosen by that deployment's operator, usually contract or consent |
We do not process special-category data, do not make automated decisions about you, and do not sell or share personal data for advertising.
Your rights
Depending on where you live, you may have rights to access, correct, delete, restrict or port your personal data, and to object to processing. Because the hosted app keeps your notes on your device, you can exercise most of these directly:
- Access and portability — export a ZIP from Settings → Backup.
- Erasure — delete notes, empty the trash, or delete all data in Settings.
- Rectification — edit any note or setting.
For anything held in hosting logs, or for a request that needs a human response, use the private contact channel. We may need to verify that a request relates to you; because we hold almost no personal data, we may be able to confirm that we hold nothing to disclose.
We do not track you across sites, so there is nothing for a “Do Not Track” or Global Privacy Control signal to switch off. We honour both by design. We do not send marketing, and we do not sell or share personal data.
Where processing is based on consent, you can withdraw it at any time; withdrawal does not affect processing that already happened.
EU/UK: you can complain to your local supervisory authority; in the UK, the Information Commissioner's Office (ICO). California: you have the rights to know, delete, correct and opt out of sale or sharing; we do not sell or share personal information, and we will not discriminate against you for exercising a right. India: under the Digital Personal Data Protection Act, 2023, you may request access, correction or erasure and raise a grievance through the contact channel.
International transfers
The website and hosted app are served by GitHub Pages and Vercel, which are based in the United States. Request data may be transferred to and processed there under those providers' data processing terms and standard contractual clauses. We do not transfer note content, because the hosted app does not send it to us.
If you use a self-hosted deployment, the location of its Supabase instance is chosen by its operator.
Hosting providers
These are the only providers involved in serving the hosted site and app. We do not use them for analytics or advertising.
| Provider | Service | What it may process | Location |
|---|---|---|---|
| GitHub (GitHub Pages) | Website hosting | Standard request logs: IP address, user agent, URL, time. | United States |
| Vercel | Hosted app hosting | Standard request logs: IP address, user agent, URL, time. | United States |
| Supabase (self-hosted by you) | Optional sync and share links | Account, notes, attachments — only on a deployment you configure. | Your choice |
If you self-host, your Supabase instance is under your control and is not a subprocessor of ours. We do not receive your notes from it.
Retention
Local notes and settings remain in your browser until you delete them or clear the site's storage. Hosting logs are retained by GitHub and Vercel under their own policies; we do not keep a separate copy. We do not have an account database to retain.
Security
The site is served over HTTPS. The hosted app has no server-side note store to breach. The code is open source and the sync path is protected by row-level security in Postgres. More detail, and how to report a vulnerability, is on the security page.
Children
Sidenote is a general-purpose productivity tool, not a service directed at children. The hosted app has no account and collects no age data. If you are below the digital age of consent where you live, please use it with a parent or guardian.
Changes to this policy
We may update this policy as the project changes. The effective date at the top always reflects the current version, and material changes are noted in the changelog and the repository history.
Contact and complaints
For privacy questions or requests, use the private report channel and mark the report “Privacy request”. For general, non-sensitive questions, open an issue at github.com/awbuilds/sidenote/issues.
The operator is an individual maintainer. A postal address is available on request through the private channel for legal correspondence.