Privacy Policy
Last updated 15 September 2026
The short version
- We keep what it takes to run Notefix: your account, your projects, and the notes people leave. It is stored on our own servers in Switzerland.
- No advertising, no tracking, no analytics cookies. We never sell data, and we never use it to train AI.
- Notes left on a customer's site belong to that customer. We look after them on their behalf.
- Delete your account and it is gone, together with the projects only you own. Backups age out within 30 days.
- Who we are
- Whose data it is
- What we keep
- Cookies
- How we use it
- Who else sees it
- Where, and how long
- Your rights
- Self-hosted
Who we are
Notefix is made and run by BBASHI GmbH, 7000 Chur, Switzerland (company number CHE-252.691.441). For anything in this policy, write to [email protected]. A person reads it and answers.
This policy covers the website at notefix.app, the documentation at docs.notefix.app, Notefix Cloud (the dashboard at notefix.app/app, and the Notefix tag that customers put on their own sites), and the emails Notefix sends. We follow the Swiss Federal Act on Data Protection (FADP), and the EU General Data Protection Regulation (GDPR) where it applies to you.
Whose data it is
Notefix handles two kinds of data, and our role differs between them.
Yours, as someone who signs in
Your account, your sign-ins, and the emails we send you. For these, BBASHI GmbH decides what is kept and why. We are the controller.
What goes into a project
Notes, drawings and screenshots; the names and optional email addresses of guests who leave notes; the pages those notes are about; and the tools a project is connected to. The project's owner, usually a company, decides what goes in and who can see it. They are the controller, and we are their processor: we store and move this data only to run Notefix for them.
If you left a note on somebody's site and want it changed or removed, ask the people who run that site first. If you cannot reach them, write to us and we will pass your request on. Customers who need a data processing agreement (DPA) can ask us for one.
What we keep
| When | What |
|---|---|
| You visit notefix.app or the docs | Nothing is stored by us. There are no cookies or analytics on these pages. Pages reach you through Cloudflare, which sees your IP address in passing (see Who else sees it). |
| You try the demo | Nothing is stored by us, and nothing is sent to us. Notes, drawings and any picture you add stay in your own browser and are cleared when you reload the page. Nobody else trying the demo sees them, and neither do we. |
| You sign in | Your email address and your name. With Google or GitHub, we receive the email address and name that account gives us (from GitHub, your primary confirmed email address). We never see a password. We do not keep a Google or GitHub access token for sign-in. |
| You stay signed in | For each browser: a random token (we store only a scrambled form of it), a label for the browser and system such as “Chrome on Mac”, and when it was created and last used. Your account page shows the list. A site where you sign in through Notefix gets a sign-in of its own, recorded the same way, with that site's address. |
| You make or join a project | Its name, its address, its site addresses, who is in it and in what role, and invitations (the invited email address and who invited them). |
| An owner connects a tool | The keys or tokens for GitHub, Jira, Trello or Slack, encrypted; which repository, project, board or channel; and whether the connection works. |
| Somebody leaves a note | What they wrote and drew, and any screenshot they chose to add. The address of the page, where on the page the note is pinned, and the size of the window. Who left it: their account, or the name a guest typed, with a random ID for their browser. A guest's email address only if they give one, and we confirm it before sending anything else. |
| You choose emails | Which emails you want and how often. |
| To stop abuse | How many sign-in links an address or connection asked for recently. IP addresses are counted in memory for this and not stored. We keep no access logs of visitors' IP addresses. |
A screenshot shows whatever was on the screen, which can include other people's details. The Notefix tag never takes one by itself. A picture reaches a note only when a person puts it there: by pasting one, by choosing a file, or by pressing Capture the screen, which asks your browser for permission and lets you choose what is shared before anything is taken.
Cookies and browser storage
notefix.app and the docs set no cookies. The dashboard, at notefix.app/app, sets two, and only the ones it needs to work:
notefix_sessionkeeps you signed in. It ends after 30 days without use, or when you sign out.notefix_signinexists for up to 30 minutes while you sign in with Google or GitHub, so a sign-in started by somebody else cannot finish in your browser.
Cloudflare may set a cookie of its own to tell people from bots.
On a customer's site, the Notefix tag sets no cookies. It keeps in that site's browser storage: your sign-in for that project, a random ID and key that make your guest notes yours, a copy of the notes so pages open quickly, and your name and preferences. Clearing that site's data removes it.
How we use it
- To run Notefix: show notes to the right people, file them in the tools a project connects, and keep your account working. This is what you signed up for (GDPR Art. 6(1)(b)).
- To send email: sign-in links, invitations, the notifications you chose, and alerts to owners when a connection stops working.
- To keep it safe: limit sign-in attempts, stop abuse, and find faults. This is our legitimate interest in a working, secure service (GDPR Art. 6(1)(f)).
- A guest's email address is used only for news about their notes, because they asked for it and confirmed it (GDPR Art. 6(1)(a)). Every such email has a link to stop.
- To answer you when you write to us.
We do not use your data for advertising, sell it, build profiles from it, or use it to train AI models.
Who else sees it
| Who | Why, and what |
|---|---|
| Cloudflare, Inc. (USA) | Carries traffic between you and our servers and protects them from attacks. It sees IP addresses and requests in transit, and stores no notes. Cloudflare is certified under the Swiss-US and EU-US Data Privacy Frameworks. |
| Google and GitHub | Only if you choose to sign in with them. They tell us your email address and name. |
| Tools a project connects | When an owner connects GitHub, Jira or Trello (Atlassian), or Slack, a note sent there carries its text, a link back to it, who left it, and for Jira and Trello its screenshots. The owner decides this, and from then on those companies' own terms and privacy policies apply to what is in their tools. |
| Brevo (Sendinblue SAS, France) | Delivers the emails Notefix sends: sign-in links, invitations and notifications. It sees the address an email goes to and what it says, and keeps delivery records for a limited time. |
| Authorities | Only when Swiss law obliges us to. |
Notefix Cloud does not take payments yet. When paid plans start, payments will be handled by a payment provider, and this policy will say which before they do.
Where it is, and for how long
Notefix Cloud runs on our own servers in Switzerland. The EU recognises Switzerland as protecting personal data adequately, so data from the EU needs no extra safeguards to be kept here.
- Your account is kept until you delete it.
- A sign-in ends 30 days after it was last used, or when you sign out.
- A sign-in link works once, for 15 minutes, and is deleted within a day. An invitation works for 14 days.
- Notes are kept until someone in the project deletes them, or the project is deleted. A deleted note leaves only a marker with its ID and time, for up to 180 days, so other browsers learn it is gone.
- A guest's email address is kept until the guest removes it or the project is deleted.
- Backups are made nightly. What is deleted from Notefix is gone from them within 30 days.
Deleting your account, from your account page, deletes your account, every sign-in, and every project you are the only owner of, with everything in it. The page shows exactly what goes before anything does.
How it is protected
- Every connection uses HTTPS.
- Sign-in tokens are stored scrambled, so a copy of the database signs nobody in.
- Keys for connected tools are encrypted, with a key kept apart from the database, and never reach the page.
- A project's notes are served only to that project's own sites, and to members only if the owner turns guests off.
Your rights
You can ask us what we hold about you, and to correct it, delete it, hand it to you in a portable form, or stop using it. Where we rely on your consent, you can withdraw it at any time. Write to [email protected]. We answer within 30 days, and may ask you to prove the email address is yours first. For notes in somebody else's project, see Whose data it is.
If you think we handled your data wrongly, tell us, and we will try to put it right. You can also complain to the Swiss Federal Data Protection and Information Commissioner (edoeb.admin.ch), or to the data protection authority where you live in the EU.
Children
Notefix is a tool for work, and not meant for anyone under 16.
Self-hosted Notefix
If you run Notefix on your own server, everything stays there. It sends nothing to BBASHI, and we cannot see it. You are the controller for whatever it holds, and this policy covers only our website and the download.
Changes
When this policy changes, the date at the top changes. If a change matters to how your data is used, we email everyone with an account before it applies.