Footnote
Sign in

Privacy Policy

Effective date: May 1, 2026

1. Overview

Footnote (“we,” “our,” or “us”) operates the Footnote Chrome Extension and the companion website at footnote.app. This policy explains what information we collect, how we use it, and the choices you have.

The short version: Your private notes are AES-256-GCM encrypted on your device before they reach our servers. We cannot read your notes. Ever. That is a hard technical guarantee, not a policy promise.

2. Information We Collect

2a. Account information

When you sign in with Google, we receive your name, email address, and profile picture URL from Google. We store these in your profile record to display your username and avatar in the discussion panel and on this website.

2b. Notes (encrypted)

Notes you write in the extension are encrypted client-side using AES-256-GCM before transmission. The encryption key is generated on your device and stored in chrome.storage.sync — it is never sent to our servers. We store only the encrypted ciphertext. We cannot decrypt it and do not attempt to.

2c. Public comments (discussion)

Comments you post in the Discussion tab are public and unencrypted. They are associated with your account and visible to all Footnote users who visit the same URL.

2d. Usage data

We do not use third-party analytics or tracking scripts. Standard server-side logs (IP address, request timestamps) are retained for up to 30 days for security and debugging purposes.

3. How We Use Your Information

  • To authenticate you and associate notes and comments with your account
  • To display your username and avatar in the extension panel
  • To sync your encrypted notes across your own Chrome installations
  • To operate the discussion features (posting, replying, deleting comments)
  • To send transactional emails related to your subscription (if applicable)

We do not sell your data. We do not use your data for advertising profiling.

4. Data Storage & Security

All data is stored in a Supabase-managed PostgreSQL database hosted on AWS infrastructure. Database access is protected by Row-Level Security policies — your notes and account data are only readable by your authenticated session.

Connections use TLS in transit. Supabase encrypts data at rest.

5. Data Retention & Deletion

You can delete your account and all associated data at any time from the Account page. Upon deletion, your profile, encrypted notes, and public comments will be permanently removed within 30 days.

6. Third-Party Services

7. Children

Footnote is not directed at children under 13. We do not knowingly collect personal information from children under 13.

8. Changes to This Policy

We may update this policy from time to time. When we do, we will update the effective date at the top of this page. Continued use of Footnote after changes constitutes acceptance of the revised policy.

9. Contact

Questions about this policy? Email us at privacy@footnote.app.

← Back to home