Privacy Policy
Notes & Todos · notes.garthenweb.de · Last updated: 30 August 2026
1. Controller
2. What this application is
Notes & Todos is a private application for writing notes and keeping track of the tasks that come out of meetings. It is offline-first: everything you write is stored first and permanently in your own browser, on your own device, and the app works completely without a network connection.
There are no user accounts held by the provider, no sign-up, no analytics, no tracking, no advertising and no profiling. Every connection that leaves your device — sync, calendar, link previews — is optional and can be switched off individually.
3. Access protection
The application is protected by a shared password. Once it has been entered, a
tpt_session cookie is set. It contains nothing but an expiry timestamp and a
cryptographic signature of that timestamp — no name, no identifier, no other personal data. Its
only purpose is to avoid asking for the password on every visit.
| Cookie | tpt_session |
|---|---|
| Purpose | Keeping you signed in (strictly necessary) |
| Lifetime | 60 days |
| Legal basis | Art. 6(1)(f) GDPR (protecting your own content) |
No other cookies are set. No tracking takes place.
4. Hosting and server logs
The application is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. Vercel processes data as a processor under a data processing agreement pursuant to Art. 28 GDPR. Serving a page necessarily produces server logs, which typically contain the IP address, the time of the request, the address requested, the status code, the amount of data transferred, the browser identification and the referrer.
The purpose is technical operation and the prevention of abuse; the legal basis is Art. 6(1)(f) GDPR. Transfers to the United States are based on the EU-US Data Privacy Framework and on the European Commission's standard contractual clauses. Vercel determines how long these logs are kept; the retention is short.
5. Data on your own device
The browser's own storage (IndexedDB) and the service worker cache hold:
- your notes as Markdown, and the tasks derived from them;
- settings such as key bindings, spellchecker language and number format;
- cached calendar entries and link headlines;
- for any connected Google account: its name, email address and profile picture;
- the application's own files, so that it starts with no network.
None of this leaves your device unless you explicitly switch on one of the optional features described in sections 6 and 7. You can remove all of it at any time by clearing the site data for this address in your browser settings.
6. Google services (optional)
There is no connection to Google unless you explicitly connect a Google account in the application's settings. Until you do, nothing is requested from Google and nothing is sent to it. There are two separate permissions, granted and withdrawn independently of one another.
6.1 Google Drive — drive.file
- Extent: only files and folders this application created itself. It has no access to the rest of your Google Drive.
- Data processed: your notes as
.mdfiles in a “Notes & Todos” folder in that account's Drive, together with the file name, file id and modification time. - Purpose: backing your notes up and keeping several devices in step.
- Where it is stored: in your own Google Drive. No copy is kept on the provider's servers.
6.2 Google Calendar — calendar.events.readonly
- Extent: read-only, and events only. Nothing is written back to your calendar, nothing is changed and nothing is deleted.
- Data processed: the title, start, end, location and link of an event on your primary calendar, plus your own acceptance status — limited to the window from yesterday to tomorrow.
- Purpose: labelling a newly created note with the meeting that was running at the time, so that later you can tell what it came out of.
- Storage: as a cache in your browser only. It is replaced on every refresh and deleted when the account is disconnected.
6.3 Account information
To show which account is connected, the account's name, email address and profile picture are retrieved and stored locally. No additional profile permission is requested for this.
6.4 Use, sharing and withdrawal
- All processing happens in your browser. The data travels directly between your device and Google and never touches a server operated by the provider.
- It is never shared with third parties, never sold, never used for advertising, never used to build profiles and never used to train AI models. No human reads it.
- The use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
- Access tokens are kept on your device only, in the browser's own database, so that a reload does not have to ask Google for a new one. They expire after about an hour, are sent to nobody but Google, and are deleted when you disconnect the account.
- Legal basis: your consent under Art. 6(1)(a) GDPR, given in Google's own consent dialog.
- Withdrawal at any time: in the application's settings via “Disconnect” or “Forget account”, and independently of the app at myaccount.google.com/permissions. Files already written to Drive stay there and can be deleted there.
7. Encrypted backup (optional)
As an alternative to Google Drive, a backup protected by a passphrase of your own choosing can be enabled. Notes are then encrypted on your device before they are sent (AES-GCM, with the key derived from the passphrase via PBKDF2); only the ciphertext is transmitted and stored. The passphrase itself never leaves your device and is not known to the provider — without it the data cannot be read. This feature is not currently set up on this installation.
8. Link previews
When you paste a web address into a note, this application's own server fetches that page and returns its title and short description. As a result the site you linked to never learns your IP address. The address is processed to make that request but is not stored permanently; the result is cached locally on your device. The legal basis is Art. 6(1)(f) GDPR (keeping your own notes readable).
9. Retention
| Notes and tasks on your device | until you delete them |
|---|---|
| Calendar cache | replaced on every refresh, deleted when the account is disconnected |
| Files in Google Drive | until you delete them in that Drive |
| Session cookie | 60 days |
| Server logs | short-term, as determined by the host |
10. Your rights
You have the right of access (Art. 15 GDPR), to rectification (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18), to data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). Consent once given can be withdrawn at any time with effect for the future (Art. 7(3)). A message to the address in section 1 is enough to exercise any of these.
Independently of that, you have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR).
11. Changes to this policy
This policy is updated when the application changes — when another interface is added, for instance. The version published here, with the date given above, is the one that applies.
← Back to the app