Privacy Policy
1. Who we are
The data controller for your personal data is FortyNote LLC, 5900 Balcones Drive, Suite 100, Austin, TX 78731, United States. FortyNote LLC is a subsidiary of AMBA Group LLC. Ownership alone grants no access to the service or to customer data: access is limited to the individuals who operate FortyNote, and is controlled, limited and logged.
Privacy questions, requests and complaints: privacy@fortynote.com.
This policy explains what we collect, how we use it, who we share it with and the choices you have. It applies to the FortyNote website, web app, browser extension and related services. It is written to meet the EU General Data Protection Regulation, the UK GDPR, the California Consumer Privacy Act as amended, and other privacy laws that apply to us.
2. What we store, and what we can’t see
Your notes, files, tags, notebooks and their titles are encrypted on your device with AES‑256‑GCM, using a key derived from your password. The key never leaves your device. What arrives on our servers is ciphertext, plus the small amount of technical information needed to sync it: how many items there are, how large each one is, when it changed, and a random identifier for each.
We hold the encrypted material, a wrapped copy of your key that your password opens, your email address, and your account record — plan, storage used, and similar counters. We do not hold your password in any form, and it is never sent to us.
We also hold an escrowed copy of your account key. It is encrypted to a key of ours that is stored separately from your notes, in Google Secret Manager, and it exists for one purpose: when you ask to reset a forgotten password, our server uses it to hand your account key back to your browser, which re-locks it under your new password. We are therefore technically capable of decrypting your notes. We do not do so for any other purpose. Access to that key is restricted and logged, we do not read notes for advertising, product analytics or model training, and we will not read them on request from anyone but you, except where section 11 obliges us by law.
This is a deliberate trade, and we would rather state it plainly than imply a guarantee we cannot keep. If you would prefer that no one but you can ever open your notes, do not rely on us for that — an encrypted archive you keep yourself is a better fit than any hosted notes service, ours included.
The practical consequence, which our Terms also set out: if you forget your password you can reset it by email and keep your notes. If you also lose access to that email address, we have no other way to confirm who you are, and your account stays locked.
On your own device. FortyNote keeps an encrypted copy of your notes in your browser's storage so the app works offline and starts quickly. That copy lives on your device, not with us. Signing out or deleting your account clears it; so does clearing your browser's site data.
3. What we collect
Account information. Your email address, which is your account name, and the cryptographic material needed to verify your password. No phone number, no name, no profile photo. We use the address to sign you in, to tell you about your account and subscription, and to send the notices we are required to send — not to build a profile of you, and never sold or shared for anyone else’s marketing. Accounts created before September 2026 have a username instead, and keep working that way. If you write to support, we have whatever you put in that message.
Payment information. If you subscribe, Stripe processes the payment and tells us only what we need to run your subscription: that it succeeded, which plan, when it renews, and a customer reference. We never see or store your card details. When you start a paid plan from one of our pricing links, the card fields appear on the sign-up screen itself, but they are Stripe’s own fields running in Stripe’s frames — the card number goes from your browser to Stripe and never passes through our code or our servers. Upgrading later from Settings sends you to Stripe’s hosted page instead.
Location. Only if you ask for it. A note has an optional location action: choose it and your browser asks your permission, then the coordinates are saved inside that note and shown to you as a map link. They are encrypted in your browser before upload, exactly like the rest of the note. We never collect location in the background and never use it for advertising. Two things worth knowing: the coordinates are precise, and if you share a note that has one attached, whoever opens that link can see it.
Technical information. Like any web service, our servers and our network provider record requests: IP address, approximate time, the page or endpoint, the response, and browser type. We use these to keep the service running and to spot abuse. We do not build profiles from them or use them for advertising.
Error and performance data. When something breaks on our servers, an error report is generated. These reports contain technical detail — a stack trace, a request path — and never your note content, which is unreadable to the server in any case.
4. The AI assistant
FortyNote includes an AI assistant. It is inert until you use it: nothing is sent anywhere unless you pick an action, and only the text you picked for that action is sent — the open note, a selection you highlighted, or the notes that match a question you asked. Your device chooses which notes are relevant; only those are sent.
That text travels from your browser, through our servers, to our AI provider, which returns the answer. This is the one place where text you have written passes through us in readable form.
We do not store the text you send or the answers that come back. Neither is written to your account, to our database, or to our logs. We keep one number per account: how many requests you have made this month, so your plan’s allowance can be applied. Our AI provider is contractually bound not to retain the text or use it to train models.
If you would rather we were not involved at all, you can connect your own AI provider account in Settings. Your browser then talks to that provider directly from your device under their terms, using your own API key, and none of it passes through us. Your key is stored inside your encrypted settings, or only on that device if you choose that option.
Not using the assistant means no note text ever reaches us in readable form.
5. The free tools on our website
Our website offers a set of tools you can use without an account — among them the word counter, the citation generator, the online notepad, the PDF editor and converter, the document scanner, the AI detector, text to speech, transcription, diagrams and the meeting note taker.
These run inside your browser. The page’s code does the work on your own device. What you type, paste, upload or open in one of these tools is not transmitted to our servers, is not stored, and is not seen by us or by anyone else. Closing the tab ends it. You need no account to use them, and we do not create one for you.
Text to speech is the one worth a footnote: it uses the voices built into your own browser and operating system. Most are generated on your device, but a few “natural” or “premium” voices are produced by the operating system vendor’s own service. If you pick one of those, the sentence being read goes from your device to that vendor under their terms. We are not involved either way, and your device’s voice settings control it.
Because these tools are on a normal website, visiting the page is still a web request: our website platform records it as described in section 8, and the cookies described there apply. That is about the visit, never about what you put into the tool.
6. How we use information, and why we are allowed to
Where the GDPR applies, our legal basis is noted for each purpose.
- To provide the service — create and authenticate your account, store and sync your encrypted content, apply your plan’s limits, deliver share links and shared notebooks. (Performance of our contract with you — Art. 6(1)(b).)
- To run the AI assistant when you use it — as described in section 4. (Performance of our contract — Art. 6(1)(b), on your instruction each time.)
- To take payment — process subscriptions and keep the records tax law requires. (Contract — Art. 6(1)(b); legal obligation — Art. 6(1)(c).)
- To keep the service running and secure — diagnose faults, monitor performance, rate-limit, and block abuse and automated attacks. (Legitimate interest in a reliable, secure service — Art. 6(1)(f).)
- To answer you — respond to support and privacy requests. (Contract and legitimate interest — Art. 6(1)(b), (f).)
- To comply with the law — meet legal, tax and regulatory obligations and respond to lawful requests. (Legal obligation — Art. 6(1)(c).)
- To defend ourselves — establish, exercise or defend legal claims. (Legitimate interest — Art. 6(1)(f).)
We will ask your consent before using your personal data for anything not described here.
7. What we do not do
We do not sell or rent your personal data, and we never share it for anyone else’s advertising. We do not run advertising or analytics trackers inside the app, and we set no third-party cookies there. We do not read your notes, profile you, or train models on your content. We require no phone number to open an account, and we do not use your email address for anything but your account, its billing, and notices we must send. Your password and recovery key are never transmitted to us.
The free tools on our website run entirely in your browser; nothing you put into them is sent to us. Section 5 covers them in full.
We may use aggregated, anonymised figures — how many accounts exist, how many notes are stored in total — that cannot be linked back to you or to any person.
8. Our website, and cookies
There are two different places with two different rules, and it is worth keeping them apart.
The app — everything behind your password — sets no advertising or analytics cookies, contains no trackers, and loads no third-party code. The only things it stores in your browser are the encrypted copy of your notes and the small amount of state needed to keep you signed in.
Our marketing website — the public pages, including the free tools in section 5 — is built and hosted on the Airo website platform, part of GoDaddy. Like most websites, it records ordinary visit statistics for us: which pages were viewed, roughly where in the world the visit came from, and which site referred you. The platform sets its own cookies to do this, currently named _tccl_visitor, _tccl_visit and _scc_session. They identify a browser across pages and visits so those counts are not double-counted. They do not follow you to other companies’ websites, and we do not use them for advertising.
A banner on first visit lets you tell us your preference for analytics cookies, and your choice is remembered in your browser. Essential cookies — the ones without which the pages cannot work — are always set.
We do not use Google Analytics, advertising pixels, or any social-network tracking on either surface.
9. Bot protection at sign-up
The sign-up form uses hCaptcha to block automated account creation. hCaptcha receives your IP address and interaction signals for that check only. It is not present anywhere else in the app.
The same screen loads Stripe’s script when — and only when — you have come from a pricing link to start a paid plan, so that the card fields can be Stripe’s rather than ours. Stripe receives your card details and your IP address in order to take the payment. Neither hCaptcha nor Stripe can read your notes: nothing of yours is decrypted on that screen, and neither script runs anywhere else in the app.
10. Who processes data on our behalf
All of these are bound by contracts limiting them to processing data for us:
- Google Cloud (United States) — hosts the service and stores the encrypted data and account records.
- Fastly — the network edge that delivers the app and terminates HTTPS; it sees requests and technical logs.
- Anthropic (United States) — the AI provider behind the assistant. It receives only the text you deliberately send, only when you use it, and does not retain it or train on it.
- Stripe — processes payments. Stripe’s card fields load on the sign-up screen when you are starting a paid plan, and on Stripe’s own hosted page when you upgrade from Settings; no Stripe code runs anywhere else in the app.
- Sentry — receives server error reports as described in section 3.
- Datadog — receives server performance metrics and technical logs.
- hCaptcha — bot protection on the sign-up form only.
- GoDaddy (Airo website platform, United States) — builds, hosts and serves our marketing website and the free tools, and provides the visit statistics described in section 8. It has no access to the app, to accounts, or to any encrypted data.
- Cloudflare — the network edge in front of the marketing website; it sees requests to those public pages and their technical logs.
The first seven handle the app. The last two handle only the public website. No processor anywhere in this list can read your notes.
11. Sharing with other people
Share links. When you create one, the note is encrypted with a fresh key that lives in the link after the “#” and never reaches us. Anyone with the link can read that note. You can revoke a link at any time.
Shared notebooks. Content in a team notebook is encrypted to the members of that notebook, who can read it. That is the purpose of sharing. Your personal notes are not part of it.
Deleting your own copy of something you shared does not delete copies other people already hold, and cannot recall what they have already read or saved.
Calendar subscriptions. If you subscribe to an external calendar, our server fetches that calendar’s address on your behalf so your browser doesn’t have to. We do not store its contents.
12. Legal requests
We interpret requests for data narrowly. We disclose personal data to law enforcement or government agencies only where we believe in good faith that we are legally compelled — by warrant, court order, subpoena or comparable process. Where the law allows, we will tell you first so you can object, and we push back on demands we consider overbroad.
It is worth being plain about what we could hand over if compelled: your email address, your account and billing record, technical logs, your encrypted data — and, because we hold the escrowed key described in section 2, the means to decrypt it. We do not hold your password. We will require a valid legal order, will object where we have grounds, and will tell you unless we are forbidden to, but we will not claim an inability that we do not have.
13. Where your data lives
Our servers are in the United States (Google Cloud, us-central1). If you are in the EEA, the UK or Switzerland, your data is transferred to the United States; we rely on the EU Standard Contractual Clauses and the UK Addendum, together with the encryption described above, which means what is transferred is unreadable without a key held separately from it.
14. How long we keep things
Your content. For as long as you keep it in your account. When you delete a note it is removed from our systems on your next sync. Encrypted copies may persist in backups for up to 30 days before they are overwritten.
Your account. For as long as the account exists. When you delete your account, your notes and account record are removed and the same 30-day backup window applies.
Billing records. Kept as long as tax and accounting law requires, typically seven years. These contain no note content.
Technical logs. Kept for up to 30 days for security and debugging, then discarded.
AI request counts. A per-month counter, kept for billing and limit purposes. It records how many, never what.
We do not close accounts for inactivity.
15. Deleting your account
You can delete your account yourself in Settings, without asking us. Export your notes first — deletion is immediate and cannot be undone. You can also cancel a subscription without deleting the account.
16. Your rights
Do it yourself. You can see, edit, export and delete everything in your account from inside the app, at any time, without contacting us. File → Export… produces a plain, readable copy of all your notes.
Formal rights. Depending on where you live you may have rights to access your personal data, correct it, delete it, restrict or object to processing, port it, or withdraw consent. Email privacy@fortynote.com. We will respond within the time your law allows, normally 30 days.
One honest limitation: an email address alone does not prove ownership of an account, so we verify requests against your account credentials. We will not hand over account information to anyone who cannot sign in — a protection for you, even when it is inconvenient.
If you have no account. Using the free tools creates no record of you with us, so there is nothing for us to show you or delete. The only trace of a visit is the website statistics in section 8, which you can clear by deleting our cookies in your browser.
Complaints. If you are in the EEA, the UK or another region with a data protection authority, you may complain to your local authority. We would like the chance to put it right first.
17. Region-specific notices
EEA, UK and Switzerland. FortyNote LLC is the controller. Transfers outside these regions rely on the EU Standard Contractual Clauses and the UK Addendum.
California. We do not “sell” or “share” personal information as the CCPA/CPRA defines those terms, and we do not use or disclose sensitive personal information beyond what the law permits. California residents have the rights to know, delete, correct and opt out described above, and the right not to be treated differently for exercising them. You may use an authorised agent. Under California Civil Code §1789.3 you may also contact the Complaint Assistance Unit of the Division of Consumer Services, 1625 North Market Blvd., Suite N-112, Sacramento, CA 95834, (800) 952-5210.
Other U.S. states and other countries. You may have similar rights under your local law; the process above applies.
18. Children
FortyNote is not directed at children. We do not knowingly collect personal data from anyone under 16, or a higher age where local law requires. If you believe a child has given us personal data, write to privacy@fortynote.com and we will delete the account.
19. How we protect your data
Beyond the encryption described above: everything travels over HTTPS; passwords are stretched with PBKDF2‑SHA256 at 600,000 iterations before any key is derived; two-factor authentication is available in Settings; your plan limits how many devices can be signed in at once; and access to our infrastructure is limited and logged. No system is perfect, so use a strong, unique password, turn on two-factor authentication, and and keep access to your email account secure — it is what a password reset goes through.
20. If something goes wrong
If we discover a personal data breach that is likely to put you at risk, we will tell you without undue delay, and notify the relevant supervisory authority within the time the law requires. We will email the address on your account, and also give that notice prominently inside the app and on our website — so if you ever see a security notice there, please read it. We will say what happened, what it affects, and what you should do.
Note what a breach would expose, depending on what was breached. Our database and file storage alone would give an attacker ciphertext, your email address and your account record — the notes would be unreadable, because the escrowed keys are held separately in Google Secret Manager. An attacker who obtained both the stored data and that escrow key could read notes. Your password would not be exposed in either case, because we never receive it.
21. Do Not Track and Global Privacy Control
There is no common standard for interpreting Do Not Track signals, so we do not respond to them. We honour Global Privacy Control signals where the law requires. Since we run no advertising or cross-site tracking, there is little for either to switch off.
22. Changes to this policy
We will post changes here and update the effective date. For material changes we will show a notice in the app at least 30 days before they take effect and, where required, ask for your consent.
23. Contact
privacy@fortynote.com · Support: support@fortynote.com
FortyNote LLC
5900 Balcones Drive, Suite 100
Austin, TX 78731, United States