Privacy Policy

1. Data controller

The party responsible for data processing described in this policy is:

Full legal identity and postal address are published in our Impressum.

2. Data we collect

Account registration and login

Authentication is handled by Supabase. If you sign in with Google, we receive your Google account ID, email address, and profile picture (if set). If you register with email and password instead, we store your email address and a securely hashed password. This data is used solely to create and manage your Zettelkasten account.

Content you create

Notes, quotes, lexicon entries, reading sessions, and book records you add are stored against your account so the app can display and sync them. This content is not shared with other users unless you explicitly use a sharing or community feature.

Payment information

If you subscribe to a paid plan, payment is processed by Stripe. We do not receive or store your card details — Stripe handles this directly and shares with us only what's needed to manage your subscription (e.g., plan status, renewal date).

Support requests

If you submit feedback or a bug report, your message and account email are sent to our support inbox via Resend so we can respond to you.

Hosting and server logs

The app is hosted by Vercel. Standard server log data (e.g., IP address, browser type, request timestamps) is collected automatically to operate and secure the service.

3. Third-party processors

We rely on the following processors to run the app. Each only receives the data it needs to perform its function:

• Supabase — authentication and database hosting
• Google — OAuth sign-in
• Vercel — application hosting
• Stripe — subscription and payment processing
• Resend — transactional and support email delivery

4. Cookies & local storage

Supabase sets essential cookies to keep you signed in. These are required for the app to function and are not used for advertising or cross-site tracking.

The app also stores a local copy of your books, notes, and reading data in your browser's on-device storage (IndexedDB), so it keeps working offline. This local copy stays on your device and syncs back to your account when you're online.

5. Legal basis for processing

We process account and content data to perform our contract with you (providing the app you signed up for), payment data on the same basis together with our legitimate interest in preventing fraud, and server logs under our legitimate interest in keeping the service secure and reliable.

6. Data retention

We keep your account and content data for as long as your account is active. If you ask us to delete your account (see Your rights), we delete it within 30 days, except where we're required to keep records longer for tax, accounting, or legal reasons.

7. International data transfers

Some of our processors (including Google, Stripe, Vercel, and Resend) may process data outside your country of residence, including in the United States. Where this happens, they do so under recognized safeguards such as the EU Standard Contractual Clauses.

8. Your rights

Depending on your jurisdiction, you have the right to access, correct, delete, or restrict the use of your personal data, to object to certain processing, to withdraw any consent you've given, and to lodge a complaint with your local data protection authority.

You can export your own data at any time — notes, books, quotes, and lexicon entries — as a full backup or spreadsheet from Account settings in the app. To exercise any other right, including account deletion, email info@zettelkasten-app.eu and we'll respond within 30 days.

9. Children's privacy

Zettelkasten is not directed at children under 16, and we do not knowingly collect personal data from them. If you believe a child has provided us with personal data, contact us and we'll delete it.

10. Changes to this policy

We may update this policy as the app changes. Material changes will be reflected by updating the date at the top of this page.