Privacy
Last updated 31 October 2026
The short version. Your notes are yours. We store the text you write and the minimum needed to run your account. There are no advertising trackers, no analytics scripts and no third-party services reading your notes.
Voice recordings are transcribed on our own server and the audio is deleted immediately afterwards. We never send your voice to a speech vendor.
You can export everything at any time, and deleting your account deletes your notes.
What we collect
- Your email address — for signing in and for transactional mail such as a password reset. Nothing else.
- Your password — stored only as a bcrypt hash. We cannot read it.
- Your notes — the text you capture, plus the tag, colour and pin state you assign to it, and the order you arrange them in on the printed page.
- Account security data — session records (so you can sign devices out), and if you enable two-factor authentication, your TOTP secret and hashed recovery codes.
- Technical data — your IP address is used transiently to rate-limit sign-in attempts against brute force, and server logs record request paths and errors. Logs are for running the service, not for profiling you.
- A phone number, only if you choose to provide one. We do not currently offer message-based capture, so an empty field is fine.
What we do not do
- No advertising, no ad networks, no sale or rental of your data. Ever.
- No third-party analytics, session recording or heat-map scripts.
- No AI training on your notes, and no AI processing of your notes at all.
- No sharing with data brokers or marketing lists.
Cookies
We use only the cookies needed to keep you signed in and to protect forms. There are no tracking cookies.
| Cookie | Purpose | Lifetime |
|---|---|---|
tabbynote_auth | Your signed-in session | 30 days, or until you sign out |
tabbynote_csrf | Stops other sites forging form submissions | 1 hour |
tabbynote_mfa | Holds a half-finished sign-in until your second factor is entered | 5 minutes |
Voice notes
When you record, the audio is uploaded over an encrypted connection to our own server, written to a temporary file, converted to text by a speech model running on that same machine, and the temporary file is deleted as soon as transcription finishes. We do not keep the audio, and it is never sent to any outside service. The transcript becomes a note, which you can edit or delete like any other.
We email you only for things you asked for: a password reset you requested, or a receipt and sign-in link if you buy a licence. No newsletters unless you opt in, and no marketing to an address you gave us for support.
Where your data lives
On a server we operate, in a database we control, in the United States. Access is restricted to the operator of this service. Data is transmitted over TLS. Passwords are hashed, and database and server access require credentials that are not stored in the application.
Your rights
- Export — download everything as Markdown, JSON, CSV or plain text, from Settings, as often as you like, on any plan.
- Correct — edit or delete any note, and change your email or password from Settings.
- Delete — ask us to delete your account and we will remove your notes, tags and account record. Deletion is permanent; export first if you want a copy.
- Ask — write to us for a copy of what we hold about you, or with any question about this policy.
If you are in a jurisdiction with a formal data-protection regime, these are the rights we honour for everyone, not just where the law requires it.
Retention
Notes are kept until you delete them or close your account. Session records expire after 30 days. Server logs are rotated and discarded. Reset links expire after one hour and are stored only as hashes.
Children
This service is not intended for anyone under 13, and we do not knowingly hold accounts for children.
Changes
If this policy changes in a way that affects what we do with your data, we will say so on this page and, for anything significant, by email.
Contact
Privacy questions: support@borlandtech.com. We are a small operation and a human answers.