Privacy Policy

1. Who we are

App Software Ltd ("we", "us") runs EtherPK's managed service and is the controller of the personal data described here. We are a company registered in England and Wales with company number 07109450, and our registered office is 1 Derwent Business Centre, Clarke Street, Derby, Derbyshire, England, DE1 2BU.

For anything about your data, including the requests in section 9, email mail@etherpk.com.

This policy covers www.etherpk.com, the app at app.etherpk.com, the Sync Server at sync.etherpk.com, and the documentation and blog sites at docs.etherpk.com and blog.etherpk.com. It does not cover a Sync Server or app that someone else runs: its operator decides what happens to your data there.

2. What we cannot see

Synced notes, files and graph names are end-to-end encrypted. Your devices encrypt them before they are sent. We hold the keys only in an encrypted vault, which only your devices and your Recovery Code can open. We store the encrypted data and cannot read it. Graphs you keep only on your device, and everything the app stores in your browser, never reach us at all.

3. What we collect and why

• Your account. Your name, email address, password (stored only as a hash), whether your email is verified, and your two-factor and passkey settings. If you sign in with GitHub or Google, we also store that account's id, the name or email it shows, your profile picture address and the tokens it gives us. We need these to provide the account you asked for (lawful basis: contract).
• Sign-in sessions. When you sign in we record the IP address and browser (user agent) with the session, to protect your account and detect misuse (lawful basis: legitimate interests).
• Your subscription. Your plan, the status and dates of your Sync+ subscriptions, and the id Stripe gives you as a customer. Stripe holds your card, billing address and invoices (section 5). We need these to provide and bill for Sync+ (contract), and to keep the tax and accounting records the law requires (legal obligation).
• What the Sync Server stores. Your encrypted notes, files, graph names and key vault. The public keys your devices use to share graphs. The information needed to sync them: which graphs exist, who owns them, who has joined them and with what role, invitations (including the invited person's email address), device approvals, the size of each graph and file, and when things change. It also stores the names and last-used times of the access tokens you create. We need these to provide the sync service (contract).
• Emails we send. To verify your email address, reset your password, and tell you about your subscription and changes to our terms (contract and legitimate interests).
• Messages you send us. The name, email address and message you give on the contact page, or in an email, so we can reply (legitimate interests).
• Server logs. Each request our servers handle is logged with the time, the page or API called (with reset tokens and email addresses removed), the result, your IP address, your browser and, when you are signed in, your account id. We use logs to keep the service secure and to find faults (legitimate interests).
• Website analytics. On the public pages of www.etherpk.com, docs.etherpk.com and blog.etherpk.com, a script counts page views: the page address without its query string, the site that linked to it, your browser, operating system, device type, screen size, language and country. It sets no cookies and we do not use it to identify you. We use it to learn which pages are read (legitimate interests). It does not run on sign-in, account or billing pages, or in the app. You can turn it off for www.etherpk.com on the Privacy choices page.
• Ad measurement. If you arrive on www.etherpk.com from one of our Reddit ads, we ask whether we may measure whether the ad worked. If you allow it, we keep a note of the ad in a cookie for 30 days: its campaign name and the click ID Reddit added to the link. If you then create an account, we keep the note with your account. When that account is created, starts a Sync+ trial or makes its first Sync+ payment, we send Reddit the event, its time and the click ID, and the amount for a payment. We send no name, email address or other identifier, and we run no Reddit code on our pages. Reddit can link the click ID to the Reddit account that clicked the ad, and uses the events to report on and improve its ads (lawful basis: consent). You can withdraw your consent at any time on the Privacy choices page, or for an account on its Account page.
• Sign-up steps. For every account, whether or not it came from an ad, we record when it was created, when it started a Sync+ trial and when it first paid, so we can count how many people take each step (legitimate interests).
• Spell check. The app downloads spelling dictionaries from dictionaries.etherpk.com the first time a graph needs a language. The request names only the dictionary - no text from your notes is sent.

We do not sell your personal data. The only data we share for advertising is the ad measurement described above, and only when you allow it.

4. Cookies and storage in your browser

The cookies below keep you signed in or remember a choice you made, so they need no consent. The one exception is etherpk-campaign, which we set only if you allow ad measurement. We set no advertising cookies from Reddit or anyone else, and our analytics sets none. You can change your choices at any time on the Privacy choices page.

The app also keeps your graphs, their search index, your encryption keys and your settings in your browser's own storage, so it works offline and opens quickly. That data stays on your device - synced graphs leave it only in encrypted form. The contact page keeps an unsent message in your browser until you send or clear it. You can delete all of this by clearing the site's data in your browser - make sure anything you need is synced or saved first.

5. Who processes your data for us

• Hetzner Online GmbH (Germany) hosts the servers that run the service, its database and our analytics.
• Cloudflare, Inc. carries all traffic to our sites and protects them, stores encrypted files (in its EU jurisdiction), sends our emails, serves the spelling dictionaries, and hosts docs.etherpk.com and blog.etherpk.com.
• Amazon Web Services stores our database backups and our logs, in London.
• Stripe takes payments, runs subscriptions, issues invoices and calculates tax.
• Google hosts the mailbox that receives your emails and contact messages to us.

If you allow ad measurement, we also send Reddit, Inc. the events described in section 3. Reddit receives them as a separate controller, under its own privacy policy.

If you choose to sign in with GitHub or Google, that company confirms who you are to us under its own privacy policy.

We may also disclose data when the law requires it, for example in response to a valid court order.

6. Transfers outside the UK

Stripe, Cloudflare, Google, GitHub and Reddit are based in the United States or process data there. When personal data goes outside the UK, it is protected by UK adequacy regulations, including the UK Extension to the EU-US Data Privacy Framework, or by the International Data Transfer Agreement or Addendum that the law provides for.

7. How long we keep it

• Your account and synced data: until you ask us to delete your account (section 9).
• Sign-in sessions: until you sign out or the session expires. The record of an expired session, with its IP address and browser, may remain until your account is deleted.
• Server logs: 30 days.
• Website analytics: 90 days.
• Ad measurement: the cookie lasts 30 days. On an account, the click ID is deleted after your first payment has been sent to Reddit, 45 days after you allowed ad measurement, or when you withdraw consent, whichever comes first. The campaign name stays with the account.
• Sign-up steps: until your account is deleted.
• Billing records: 6 years after the end of the tax year they relate to, as UK tax law requires.
• Messages you send us: as long as we need them to deal with your query.
• Backups: deleted data remains in our database backups until they expire, at most 90 days later. Synced notes and files in backups are still encrypted.

8. Security

All connections to our sites use HTTPS. Passwords are stored as hashes, sign-in can be protected with two-factor authentication or a passkey, and synced content is end-to-end encrypted. Access to the servers and data is limited to the people who run the service.

9. Your rights

Under UK data protection law you have the right to:

• get a copy of the personal data we hold about you
• have inaccurate data corrected
• have your data deleted
• restrict or object to how we use it, including where we rely on legitimate interests
• receive the data you gave us in a portable form
• withdraw your consent to ad measurement at any time, on the Privacy choices page or your Account page

To use any of these rights, email mail@etherpk.com from the address on your account. We reply within one month.

Deleting your account. The account pages do not have a delete button yet, so email us. Cancel any Sync+ subscription first. We then delete your EtherPK Account, the graphs you own with their encrypted notes and files, and your Sync Server records within 30 days, keeping only the billing records the law requires. Graphs other people own stay theirs, including the encrypted edits you made in them. The encrypted notes in your synced graphs cannot be decrypted by us, so to keep a readable copy, save one with the Local Mirror before you ask.

10. Complaints

If you are unhappy with how we handle your data, contact us first. You can also complain to the Information Commissioner's Office, the UK data protection regulator, at ico.org.uk or on 0303 123 1113.

11. Changes to this policy

When we change this policy we update the date at the top. We email you before a change that affects how we use your data.