Privacy policy

Draft: this policy is being finalised.

Jottera is a notepad. We keep your notes so they're on every device you use, and that's what we use them for. No ads, no selling data, no tracking.

Who we are

Jottera is run by Jottera, Boden, Sweden ("we"). We're responsible for your personal data under the EU's General Data Protection Regulation (GDPR). Questions or requests: support@jottera.com or our support page.

What we store

• Your account: your email address, your name if you add one, and your sign-in sessions (when, and the browser or device and its IP address, so you can sign out other devices and we can stop abuse).
• What you write: your notes, todos, folders, images, reminders and settings.
• Sharing: who you've shared notes and folders with (their email addresses and access level), and public links you've turned on.
• Reminders: if you turn on notifications, the push address your browser or device gives us to deliver them.
• Billing: if you subscribe to Jottera Plus, Stripe handles payment. We never see or store your card details; we keep your plan, its status and renewal date, and a reference to your Stripe customer record.
• Support: messages you send us, kept for a year.
• Abuse protection: to limit sign-in attempts and messages, we briefly use your IP address (for the support form, only as a scrambled code).

We use one cookie, to keep you signed in. There are no advertising, analytics or tracking cookies. To work offline, the app also keeps a copy of your notes on your device; signing out removes it.

Why we use it

• To provide Jottera: store and sync your notes, share them as you ask, send sign-in codes, invitations and reminders (our contract with you).
• To keep it secure and stop abuse (our legitimate interest in running a safe service).
• To take payments and keep the records tax law requires (our contract with you, and legal obligations).
• To send notifications, only if you turn them on (your consent, which you can withdraw in Settings).

Your notes aren't read by people at Jottera. We'd only look at something if you ask us to help with it, or if the law requires us to. They aren't used to train AI or for anything else.

Who helps us run Jottera

These companies process data for us, only to provide their service, under data processing agreements:

• Railway: hosting, database and image storage, in the EU (Amsterdam).
• Stripe: payments and invoices for Jottera Plus.
• Resend: sending emails (sign-in codes, invitations, support replies).
• Cloudflare: domain name service for jottera.com.
• Google or Microsoft: only if you choose to sign in with them; they tell us your email address and name.

Some of these companies are based in the United States. Where your data leaves the EU or UK, it's protected by the European Commission's standard contractual clauses or an equivalent safeguard.

Security

Everything is sent over encrypted connections, and stored on encrypted disks. Notes aren't end-to-end encrypted, which is what lets them sync, be searched and be shared. Only you, people you share with, and anyone with a public link you've turned on can open your notes.

How long we keep it

• Your notes, until you delete them. Notes in the Trash are deleted for good after 30 days.
• Deleted data can stay in our backups for up to about four weeks before it's gone everywhere.
• If you delete your account, we delete it and everything in it straight away (apart from those backups). Notes and folders you shared pass to someone you gave Can edit & invite access, if there is anyone, or are deleted for everyone.
• Billing records, as long as tax law requires (usually up to 10 years), held by Stripe.
• Support messages, for a year.

What others see

People you share with see your name and email address, and you see theirs. Anyone with a public link can read that note, without seeing who wrote it.

Your rights

You can see, correct, download and delete your data. Most of it you can do yourself: export everything from Settings → Your data, and delete your account from Settings → Danger zone. For anything else (a copy of what we hold about you, a correction, or an objection), contact us; we'll answer within a month. You can also complain to a data protection authority: in Sweden that's IMY (Integritetsskyddsmyndigheten), or the authority where you live.

Children

Jottera isn't meant for children under 16 without a parent or guardian's permission.

Changes

If we change this policy in a way that matters, we'll tell you by email or in the app before it takes effect.

Last updated 12 November 2026.