DotnoteInstall

Legal

Privacy Policy

Dotnote stores your notes in your Cloudflare account. Optional diagnostics never include notes or your password.

Last updated: October 28, 2026

This Privacy Policy describes how Strum Technology Corp, a Delaware corporation doing business as Dotnote ("we", "us", or "our"), handles information when you use the Dotnote web application deployed to your Cloudflare account, the install site at dotnote.cloud, optional diagnostics, and related documentation (together, the "Software").

The short version: Your note files live in your Cloudflare R2 bucket inside your account. Your password stays there too, as a hash. If you opt in, Dotnote Cloud receives your email and the address of that deployment — never note titles, folder names, or bodies. This marketing and install site does not store your notes. Optional AI uses your API keys on your Worker and sends note context to the provider you choose.

1. We do not operate a notes cloud

We do not collect, receive, or store:

  • Note titles, folder paths, or markdown bodies (except when you enable AI and your Worker sends context to a provider you configured)
  • Workspace trees or version history contents from your R2 bucket
  • Raw LLM API keys (keys are stored in your deployment's database; the browser only receives masked values)

Your notes are stored as files in Cloudflare R2 and metadata in Cloudflare D1 in the Cloudflare account where you installed Dotnote.

What Where it lives Do we receive it?
Note .md files and history Your R2 bucket No
Workspace index, sessions, LLM keys Your D1 (your account) No
Password hash Your D1 database No
Email, Cloudflare account id, Worker name and address Dotnote Cloud, only if you opt in Yes, when you consent
Optional AI requests Your Worker → provider you choose We do not proxy or log them
Install OAuth tokens Used during setup; not stored with notes Transient / installer scope

2. Optional diagnostics

The owner account, including the password hash, is stored in your deployment. Signing in sets an HttpOnly session cookie on your Dotnote Worker origin. We do not receive your password.

If you opt in, that deployment sends a registration to Dotnote Cloud:

  • Your email
  • Your Cloudflare account id
  • The Worker name and the address of that deployment
  • A random instance id and the Dotnote version

A registration does not include your password, note titles, folder names, note bodies, workspace names, or API keys.

You can decline during account creation. Nothing is sent until you opt in. You can turn it off later in Settings → Account, and you can delete a registration from there. Setting DOTNOTE_DIAGNOSTICS_ENABLED to false, or removing the DOTNOTE_DIAGNOSTICS_TOKEN secret, stops sending even if you had opted in. A source install that never sets the token does not send a registration.

We use a registration to recognize a deployment and to operate Dotnote Cloud, including security and product notices you opt into. We do not sell it or use it for advertising.

3. Your Cloudflare deployment

After install, the app runs on Cloudflare Workers with Static Assets, D1, and R2 in your account.

  • Cloudflare's terms and privacy policy apply to infrastructure in your account.
  • You are responsible for Cloudflare billing, bucket access policies, and backups.
  • Public share links you create expose the linked note to anyone with the URL until you revoke the link.

4. Optional AI (your keys, your provider)

AI is off until you add an API key in Settings → AI on your deployment.

  • Keys are stored in your deployment's D1 database. The browser sees only masked key fragments.
  • When you use ⌘J or Ask AI, your Worker sends requests to Anthropic, OpenAI, xAI, or Google (whichever you configured), using your key.
  • Those requests can include note content, selected text, and your instructions so the model can edit or answer.
  • We do not resell AI, bundle credits, or receive a copy of prompts or completions.
  • The provider you choose processes data under their privacy policy and terms. Review them before enabling AI on confidential notes.

5. Install site (dotnote.cloud)

The install site guides you through OAuth with Cloudflare to create Workers, D1, R2, and related resources in your account.

  • The site orchestrates install steps; it does not persist your notes.
  • Cloudflare may process standard HTTPS request metadata when you load pages or complete OAuth.
  • We do not run advertising analytics on this site.

6. Marketing website

The website at dotnote.cloud is a marketing and install site. We do not run Google Analytics or advertising cookies on it.

The site is hosted on Cloudflare. Cloudflare may process request logs (IP address, user agent, URL) as part of delivering pages.

If you email us at the addresses below, we process that message to respond.

7. How we use information

We use limited information from an optional diagnostics registration, support email, and CDN delivery only to:

  • Recognize a deployment that opted in, and send notices you asked for
  • Deliver the website and install flow
  • Respond to support or privacy requests
  • Protect services from abuse
  • Comply with law

We do not sell personal information.

8. Data retention

Data Retention
Notes, folders, history In your R2/D1 until you delete them or tear down the deployment
Diagnostics registration Until you delete it in Settings → Account, or ask us to delete it
Support email As needed to resolve the request
CDN / website logs Per Cloudflare infrastructure practices

9. Your choices and rights

You can:

  • Deploy Dotnote only in a Cloudflare account you control
  • Leave AI disabled or remove API keys
  • Revoke public share links at any time
  • Email privacy@dotnote.cloud to ask what we hold about you (for example a support thread) and to request access, correction, or deletion where applicable

Depending on your location, you may have additional privacy rights. We will not discriminate against you for exercising them.

10. Children's privacy

The Software is not directed to children under 13. We do not knowingly collect personal information from children under 13. Contact us if you believe a child has provided information and we will take appropriate steps.

11. Security

Sessions use HttpOnly cookies in production. Traffic uses HTTPS. You are responsible for securing your Cloudflare account, Worker secrets, and share links you create.

12. Changes to this policy

We may update this Privacy Policy by posting a new version on this page and updating the "Last updated" date. Continued use after an update constitutes acceptance where permitted by law.

13. Contact us