Last updated October 6, 2026

Privacy policy

The short version. Your notes, and the pictures and files you attach to them, go straight from your browser to your own Google Drive or Dropbox, and never pass through our servers. What we keep is what it takes to let your devices reach your storage and to know whether you have paid: an encrypted key to your storage, which storage accounts you connected and their email addresses, and your subscription’s email address. We don’t sell anything about you, we run no analytics or advertising, and the code is open source, so you can check all of this.

Who we are

The hosted Skysa Notes service, at skysa.com and notes.skysa.com, is run by David Furman, a sole proprietor doing business as Skysa (“Skysa,” “we”). We decide what personal information the service handles and why. Write to support@skysa.com about anything in this policy.

This policy covers the hosted service only. If you run Skysa Notes yourself from the public code, you are the one running it, and this policy does not apply to your copy.

Your notes

Every note is a Markdown file in a folder in your own storage, and a picture or other file you attach to a note is kept beside it in the same folder. The app in your browser reads and writes those files directly with your storage provider. Our servers never receive, store or log the contents of a note or an attached file, a note’s title, or any file’s name.

To let your devices do that, our server holds an encrypted key (an OAuth refresh token) for the storage account you connect, and hands your devices short-lived access from it. That key reaches only what the app is allowed to see: on Google Drive, the files the app created; on Dropbox, the app’s own folder. Our code never uses it to read your files, and the code is public.

While the app is open, each device keeps a connection to our server, so that when one device saves a change your other devices hear of it within seconds rather than at their next check. It carries no note content and no file names, only that something changed. It does mean our server learns when a connected storage account is edited, and from which of its signed-in devices; we keep no record of it.

Your notes are also kept in your browser’s storage on each device, so the app works offline, with the attached files that device added or has opened. That copy never leaves the device except to sync with your storage. If you use the app without connecting storage (the free tier), everything stays on that device and we hold nothing about you at all.

When you enter a connect code, your browser keeps a device token in its storage in the code’s place, so that device can connect storage later without another code. The token holds your subscription’s email address, encrypted so that only our server can read it, and we keep no copy of it. It stops working after 180 days unused, when your subscription ends, or when we revoke your devices’ tokens at your request.

What we keep, and for how long

What	Why	How long
A connected storage account: the provider, the account’s ID and email address, the encrypted key to it, and when it was connected and last used	To let your devices sync, and to show you which account is connected	Until it is disconnected on the last of your devices that holds it, which deletes it and asks the provider to revoke the key. Disconnecting on one device signs out only that device. If you stop using the app without disconnecting, it stays until you ask us to delete it
Each signed-in device: a random ID, a one-way hash of the device’s sign-in credential, the kind of browser and system it connected from (such as “Chrome on Mac”), and when it was created and last used. Not the browser’s full identification string, and no IP address	To let a device in, and to list your devices so you can sign one out	While the account is connected (a device idle for 180 days stops syncing until it connects again). Once a device is signed out or the account disconnected, the record is cut off from your account and keeps nothing that names you
Your subscription: its Stripe customer and subscription IDs, your email address, its status and its dates	To know whether your storage accounts may sync	For as long as the subscription exists, and afterward so that subscribing again with the same address picks up where you left off. Deleted on request
Which storage accounts you linked to the subscription: each account’s provider, ID and email address, your subscription’s email address, and when it was linked or unlinked	To let every account you linked sync under one subscription, and to answer billing questions	Including links you have ended, until you ask us to delete them. Disconnecting an account on the last of your devices that holds it ends its link
Connect codes: a one-way hash of each code, the address it was sent to, and when	To check a code you type, and to limit how many codes an address gets	A code works for 5 minutes. Its record is deleted once it is an hour old, the next time anyone asks for a code
Device token revocations: your subscription’s address, and the time before which its device tokens stopped working	To end the device tokens of a subscription when you ask, or when one is misused	Until you ask us to delete your information
Free access we grant (for example to beta testers): the email address, until when, and a short note of why	To honor it	Until you ask us to delete it, including after it ends
Logs: a short record when something fails on our servers, written never to include an email address, a code or a key; and Cloudflare’s records of requests it blocks or slows down to stop abuse, which include the IP address and the address requested	To keep the service running, find faults and stop abuse	A few days at most, under Cloudflare’s retention

Our database host can restore our databases to an earlier point for a limited period (currently up to 30 days), so something deleted can stay recoverable until that period passes. We also keep an encrypted backup of each database every night, and delete each backup after 30 days.

We never have a password for you, because there is no account to create. Your storage account is how the app knows you, and your subscription’s email address is how we know you paid.

What we get from your storage provider

When you connect storage, you sign in with Google or Dropbox on their own page and choose to let Skysa Notes in. The provider then tells us your account’s ID and email address, and gives us the key described above. We ask for no more than the app needs:

Google: your email address and Google account ID (openid, email), and access to only the Drive files Skysa Notes creates (drive.file).
Dropbox: your account ID and email address (account_info.read), and access to the app’s own Dropbox folder.

We use what we get from any provider only to provide the sync you asked for, never for advertising, never to train any model, and we do not sell it or let anyone else read it. The next section says this in full for Google.

Google user data

This section is about the information Skysa Notes gets from your Google Account when you connect Google Drive. It applies alongside the rest of this policy.

What the app accesses

Your Google account ID and email address, from Google sign-in (openid, email).
The Drive files Skysa Notes created, and only those (drive.file): the skysa-notes folder in your Drive, a folder in it for each notebook, the notes, each a Markdown file, the pictures and other files you attach to notes, each beside its note, and a small file marking the folder as Skysa Notes’, with their names, sizes and modification times. The app cannot see, list or open any other file in your Drive.
An OAuth refresh token, which Google gives our server so your devices can keep syncing, and the short-lived access tokens made from it, which last about an hour.

We don’t ask for your name, profile photo, contacts, calendar, Gmail, or any other Google data.

How it is used

Your notes and attached files: the app in your browser reads, creates, changes, renames, moves and deletes the files in the skysa-notes folder, when you write, edit or organize notes or attach files to them, so that every device you connect shows the same notes and files. That is all it does with them. They go between your browser and Google directly and never reach our servers.
Your account ID tells our server it is the same Google account when you connect it on another device or connect it again.
Your email address is shown in the app so you can tell which account is connected. It is also kept with your subscription’s record of the accounts linked to it, so that we can answer billing questions.
The refresh token is used only to get access tokens for your own devices, and to revoke access when you disconnect. Our server never uses it to read your files.

We don’t use Google user data for advertising, to build a profile of you, to decide on credit or lending, or to develop, improve or train any artificial-intelligence or machine-learning model. No one at Skysa reads it, except with your explicit permission (for example, when you ask us to look into a problem), when it is needed for security, or when the law requires it.

Who it is shared with

We don’t sell Google user data, and we don’t share, transfer or disclose it to anyone, with three exceptions:

Cloudflare, which hosts our servers and database, to run the service.
Where the law requires it.
As part of a merger, acquisition or sale of the service, and only after asking for your explicit consent first.

Your notes and attached files themselves are shared with no one: they exist only in your Drive and in your browser’s storage on the devices you use.

How it is stored and protected

On our servers (Cloudflare’s database): your Google account ID, your email address, and the refresh token. The refresh token is encrypted with AES-256-GCM, and the key to it is kept apart from the database.
Access tokens are passed to your device and are not kept by our server. Your device keeps its current one in the browser’s storage until it expires.
Your notes and attached files are kept in your Drive and in your browser’s storage on each device, and not on our servers.
In transit, everything moves over encrypted connections (HTTPS). Only the operator of the service can reach the database.

How long it is kept, and how to delete it

Disconnect Google Drive in the app on the last of your devices that holds it. That deletes your account ID, email address and refresh token from our connection record, and asks Google to revoke Skysa Notes’ access. Your notes stay in your Drive.
Remove Skysa Notes from your Google Account’s third-party connections at any time. Our key stops working at once.
Write to support@skysa.com to have everything we hold about your Google account deleted, including the record of which accounts were linked to a subscription. We do it within 30 days.
To delete the notes and attached files themselves, delete the skysa-notes folder in your Drive. Clear the site’s data in your browser to remove the copy on a device.

Deleted records can stay recoverable in our database host’s restore window (currently up to 30 days) and are then gone.

Skysa Notes’ use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

Who else handles it

We use a small number of service providers, each only for the part of the service it runs:

Cloudflare hosts the site, the app and our databases, keeps the request logs above, and protects the service from attacks.
Stripe runs checkout, billing and the page where you manage your subscription. Your card details go to Stripe, never to us. Stripe sends receipts and billing emails, and keeps payment records as the law requires. See Stripe’s privacy policy.
ZeptoMail, by Zoho, sends connect codes. It receives your address and the email, which contains the code, and keeps a record of messages sent for a limited time. Opens and clicks are not tracked.
Your storage provider (Google or Dropbox) holds your notes and attached files under its own terms and privacy policy, as it holds the rest of your files.

These providers store and process data in the United States and in other countries where they operate. We share personal information with others only if the law requires it, and we would tell you unless the law forbids that. We do not sell or share personal information for advertising.

Cookies and tracking

The site at skysa.com sets no cookies and runs no scripts. The app sets two short-lived cookies, only while you connect storage: one holds the sign-in in progress (10 minutes), and one lets a repeated return from the provider’s page land in the same place (5 minutes). Cloudflare may set its own cookie to tell people from bots. There are no analytics, advertising or tracking cookies, and no third-party scripts.

One thing to know: if a note shows an image from elsewhere on the web, your browser fetches that image from the site that hosts it, which sees your IP address like any other visit.

Your choices and rights

Disconnect a storage account in the app at any time. On one device that signs out only that device; on the last of your devices that holds it, it deletes our record of the account and revokes our key where the provider allows. You can also remove Skysa Notes from your Google or Dropbox account’s connected apps.
Cancel your subscription from the subscription page. Your notes stay in your storage and on your devices.
Ask us at support@skysa.com for a copy of what we hold about you, to correct it, or to delete it. We will answer within 30 days. Depending on where you live, you may have further rights under your local law, and we will honor them.

Your notes are already yours to take anywhere: they are plain files in your storage, beside the files attached to them, and the app can download every note as Markdown at any time, with the attached files the device holds a copy of.

Security

Storage keys are encrypted, device credentials and connect codes are stored only as one-way hashes, and device tokens are not stored on our servers at all. All traffic is encrypted. No system is perfectly secure; if a breach ever affects your information, we will tell you as the law requires.

Children

Skysa Notes is not meant for children under 13, and we do not knowingly collect information from them. If you think a child has given us information, write to us and we will delete it.

Changes to this policy

If we change this policy, we will post the new version here with a new date. If a change matters to subscribers, we will email them before it takes effect.

Contact

David Furman, a sole proprietor doing business as Skysa
support@skysa.com