Privacy Policy

1. What data we collect

We only collect what's necessary to operate the service:

Account: name, email, and password (stored hashed, never in plain text), or, if you sign in with Google, your name and email provided by Google.
Content: the Nodes, notes, tags, attachments, and settings you create in the app.
Security: IP address and metadata from login attempts, used only to prevent brute force and abuse (see Security below) — never used for tracking or advertising.
Notifications: if you enable push notifications, we store the technical identifier (endpoint) of your browser subscription.

2. How we use your data

To operate your account and the service (authentication, syncing your Nodes across devices, sending due-date reminders), to protect your account (2FA, detection of unauthorized access attempts), and for essential communications (password reset, security notices). We do not sell your data, do not use it for advertising, and do not share it with third parties for marketing purposes.

3. Who we share data with

We use service providers strictly to operate the app: hosting (the server where data is stored), transactional email delivery (password reset), and, if you choose to sign in with Google, Google itself for authentication. These providers have limited access, only as needed to provide the service, and cannot use your data for other purposes.

4. Security

Passwords are stored hashed (bcrypt), we offer optional two-factor authentication (TOTP) and biometric login (passkeys), we rate-limit login attempts to make brute force harder, and we use encrypted connections (HTTPS) and browser security headers. No system is 100% immune to failures, but we follow recognized industry practices to reduce risk.

5. Your rights (LGPD)

At any time, directly in the app, you can: export a copy of all your data (Profile → Export my data) and permanently delete your account and all associated content (Profile → Delete account). You can also correct your name/email in Profile. For other requests (confirmation of processing, portability in another format, objection), write to the email below.

6. Retention and deletion

We keep your data for as long as your account exists. When you delete your account, your data (Nodes, attachments, settings, credentials) is permanently erased from the database immediately — this action cannot be undone. Any existing backups are overwritten in the normal backup rotation cycle.

7. Cookies

We use only one essential session cookie to keep you signed in — we do not use tracking cookies, third-party analytics, or advertising cookies.

8. Changes to this policy

Material changes to this policy will be communicated by email or an in-app notice before they take effect.

9. Contact

To exercise your rights or ask questions about this policy, write to support@nodease.com.