Local-First Sandbox
Your note content, titles, code snippets, and spreadsheets remain on your physical device in browser IndexedDB. We never access, index, or sell your private text.
AdSense & Analytics
To support free note taking, Google AdSense serves relevant ads using cookies (including DART cookies). Easy opt-out links are provided below.
Zero-Knowledge Encryption
When using optional capability sharing or multi-device sync, data is encrypted in your browser using AES-GCM-256 before transmission.
1. Local-First Architecture & Note Content Isolation
Unlike legacy cloud notepads that transmit every keystroke to centralized databases, QNotepad operates on a local-first paradigm.
- Browser Storage (IndexedDB): By default, all notes, sketches, checklists, and spreadsheets are saved directly inside your web browser's local IndexedDB sandbox (qnotepad-local).
- Zero Plain-Text Transmission: When typing in the editor, your text is never sent across the network to our servers. We have no mathematical or architectural ability to read, analyze, search, or monetize your note bodies.
- Data Sovereignty & Local Backup: Because your notes reside locally, clearing your browser history, site cookies, or cache may clear IndexedDB. We strongly encourage users to utilize the toolbar's Backup tool to export periodic JSON snapshots to local disk.
2. Google AdSense & Third-Party Advertising
To provide QNotepad as an unconditionally free service without paywalls or subscriptions, we display third-party advertisements on our website.
Google LLC & DoubleClick DART Cookies Policy:
- Third-Party Vendors: Google, as a third-party vendor, uses cookies to serve advertisements on https://qnotepad.com.
- DART Cookies: Google's use of advertising cookies (including the DoubleClick DART cookie) enables Google and its partner networks to serve ads to users based on their visits to QNotepad and other websites across the Internet.
- Ad Personalization Opt-Out: Users may choose to opt out of personalized advertising by visiting Google Ads Settings at https://www.google.com/settings/ads. https://www.google.com/settings/ads.
- Universal Third-Party Opt-Out: Alternatively, users may opt out of third-party vendor cookies for interest-based advertising by visiting the Digital Advertising Alliance Consumer Choice page at www.aboutads.info or the Network Advertising Initiative at www.networkadvertising.org. www.aboutads.info / www.networkadvertising.org.
- Strict Note Isolation: Third-party advertising scripts are executed within standard web container boundaries and have strictly zero access to the text, code, titles, or attachments of your notes.
3. Web Analytics & Server Log Files
Like most modern web platforms, QNotepad collects non-personally identifiable diagnostic and traffic data:
- Google Analytics (GA4): We use Google Analytics to measure aggregate metrics such as daily active visitors, device form factors (mobile vs. desktop), browser engines, approximate geographic region (country/city level), and general page load performance. IP addresses are anonymized.
- Edge Server Logs: Edge routing infrastructure (Cloudflare Workers) may process standard HTTP request headers (IP address, user agent, requested URL path, timestamp) for DDoS mitigation, rate limiting, and network abuse prevention. These logs are automatically cycled and never linked to note text.
4. Cookie & Storage Transparency Table
A comprehensive categorization of all storage mechanisms utilized when you visit QNotepad:
| Category | Provider | Item / Key | Purpose & Description |
|---|---|---|---|
| Essential | QNotepad | IndexedDB (qnotepad-local) | Stores all offline notes, version history snapshots, and custom folders locally on your device. |
| Essential | QNotepad | localStorage (qnotepad-theme) | Persists light/dark visual theme and user interface preferences. |
| Analytics | Google Analytics | _ga, _ga_* | Calculates visitor sessions, bounce rates, and traffic sources to help optimize app loading speed. |
| Advertising | Google AdSense | __gads, __gpi, IDE | Serves targeted and non-targeted advertisements, controls ad frequency, and prevents ad fraud. |
5. Optional Encrypted Sharing & Multi-Device Sync
If you voluntarily use QNotepad's network features, your privacy is protected by client-side cryptography:
- Ephemeral Share Links (/share/[id]#key=...): When creating a share link, your browser generates a 256-bit AES-GCM encryption key using the standard Web Crypto API. The payload is encrypted locally, and the decryption key is placed strictly in the URL hash fragment (#key=...). Hash fragments are never transmitted to edge servers in HTTP request headers.
- Passwordless Multi-Device Sync: Sync enrollment uses passwordless email verification codes (OTP) or Google OAuth. The Master Notebook Key is wrapped using PBKDF2 (100,000 iterations) with a locally derived salt. The server stores only encrypted ciphertext envelopes.
6. European Privacy Rights (GDPR & UK Data Protection)
If you are located in the European Economic Area (EEA) or the United Kingdom, you possess statutory rights under the General Data Protection Regulation (GDPR):
- Right of Access: You may request confirmation of whether we process any personal data relating to you.
- Right to Rectification: You may correct inaccurate or incomplete technical profiles.
- Right to Erasure ("Right to be Forgotten"): You can wipe local notes immediately by deleting them in the app or clearing browser data. You can permanently purge any published or shared notes using the provided revocation token.
- Right to Data Portability: You can export your entire notebook into atomic JSON, plain text (.txt), Markdown (.md), or HTML at any time with a single click.
- Right to Withdraw Consent: You may revoke cookie consent at any time through your browser cookie settings.
7. California Consumer Privacy Act (CCPA) Disclosures
Under the California Consumer Privacy Act and California Privacy Rights Act (CPRA), California residents are entitled to specific disclosures:
"Do Not Sell or Share My Personal Information" Guarantee:
QNotepad does not sell your personal information, private writing, or note contents for monetary or commercial consideration. We disclose advertising cookie identifiers to Google AdSense solely to deliver digital advertisements.
California residents may exercise their rights to know, delete, or opt-out of advertising cookies by visiting aboutads.info or contacting contact@qnotepad.com.
8. Children's Online Privacy Protection Act (COPPA)
QNotepad is a general-audience productivity tool intended for individuals aged 13 and older. We do not knowingly collect, solicit, or store personal identifiable information from children under the age of 13. If you believe a child under 13 has provided personal data to us, please notify us immediately at contact@qnotepad.com and we will promptly purge such records.
9. Privacy Inquiries & Data Controller
For questions regarding our privacy practices, Google AdSense integration, or cryptographic specifications, please reach out to our privacy officer:
Last modified: September 2026. This policy applies to all domains and subdomains under https://qnotepad.com.