Privacy Policy

Effective: October 15, 2026 · Applies to MyNote Server (https://mynote.nadooyo.co.kr) and the MyNote apps and web app connected to it

This policy explains how the operator of this MyNote server ("we") receives, uses and protects information about its users ("you"). This is a privately operated server; only Google accounts approved by the operator can sign in.

1. Information we receive

• Google account data (Google sign-in, scopes openid email profile): e-mail address and whether it is verified, name, profile picture URL, and your Google account ID (sub). We never receive your Google password or any other Google data (contacts, Drive, Gmail, …).
• Profile changes you make: a display name and an uploaded profile picture (WebP, ≤ 64 KB).
• Device information: device name, type (Windows, Android, web, …), browser type, the device's public key, connection and last-seen times.
• Notes and files are stored only end-to-end encrypted by your devices. Neither the server nor the operator can read note contents, file names or folder structure — only the size, number and change times of encrypted files.
• Note keys: only encrypted key envelopes; never the keys, your recovery key or temporary passwords in plain text.
• Account PIN: only a one-way verifier (scrypt).
• Published pages: notes and attachments you choose to publish are public (except password-protected sites).
• Access logs: time, path, result and IP address of requests, used only for security and troubleshooting and deleted automatically after a short time (about 30 MB of log files).

2. How we use it

To sign you in, keep your space (vaults, devices, sites) separate from other users, sync between your devices, approve new devices, run temporary-password sessions, check your account PIN, show your profile, and protect the server against abuse. We do not use your information for advertising, profiling, sale or AI training.

3. Google user data

MyNote's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google data is used only for signing in and showing your profile, and is not shared with anyone.

4. Storage and sharing

All information is stored only on this server, which the operator manages. We do not sell or share it with third parties and use no ads or third-party analytics. During sign-in your browser talks to Google directly under Google's privacy policy. We respond to lawful requests only as required by law; your notes are encrypted, so we cannot disclose their contents.

5. Cookies

No tracking cookies. We only use a one-time cookie that protects the sign-in flow (10 minutes), the server administrator's session, a viewing cookie for password-protected published sites, and a login-protection cookie that recognises a browser. The apps and the web app use device tokens instead of cookies.

6. Retention and deletion

Account data and notes are kept until you ask for deletion or the operator deletes the account; earlier file versions are kept for 365 days. Device connections end immediately when you log out or revoke them; "don't remember" web sessions end after 12 hours and temporary-password sessions after at most 8 hours. To have your account, devices, vaults (all versions) and sites deleted, contact us below; backups are deleted on the operator's backup schedule. You can also remove MyNote's access in your Google account → Third-party apps.

7. Security

HTTPS in transit, end-to-end encryption of notes, one-way hashing (scrypt) of passwords and PINs, hashed tokens, rate limits on sign-in attempts and least-privilege access.

8. Your rights

You may ask at any time to access, correct, delete or stop the processing of your information. The service is not intended for children under 14.

9. Contact

Privacy questions and deletion requests: rlawogud970301@gmail.com