Privacy Policy

1. Information We Do Not Collect

Unlike cloud-hosted note applications, DevNotes is engineered to run client-side in your web browser. Under ordinary operation:

• No User Account: You do not need to register, log in, or provide an email address, name, or phone number to use DevNotes.
• No Telemetry or Analytics: We do not track page views, click events, session recordings, device fingerprints, or usage statistics.
• No Advertising or Tracking Cookies: DevNotes does not deploy third-party advertising scripts or tracking pixels.

2. Local Storage and Data Persistence

All data you create in DevNotes—including markdown notes, folder hierarchies, tags, word count targets, typography preferences, and UI states—is saved locally to your device using the browser's localStorage API.

• Your data resides exclusively on your computer or mobile device.
• Clearing your browser storage or website data will remove your locally saved notes unless you have backed them up.
• You retain complete control of your data and can export all notes at any time in standard JSON or Markdown formats.

3. Client-Side Note Encryption

DevNotes provides end-to-end client-side encryption for sensitive notes using the Web Cryptography API (AES-GCM 256-bit with PBKDF2 key derivation and random salt):

• Encryption and decryption are performed entirely within your browser runtime.
• Your encryption passphrase is never transmitted to any server or stored in persistent storage. It remains solely in volatile browser memory while unlocked.
• If you forget your passphrase, encrypted notes cannot be decrypted or recovered by anyone, including the creators of DevNotes.

4. Optional Note Sharing Feature

DevNotes includes an optional feature allowing you to generate public share links for individual notes:

• User-Initiated Only: No note is ever sent to a server unless you explicitly click the "Share Note" button and choose to generate a public link.
• Data Transmitted: When you generate a share link, the title, content, language tag, and creation timestamp of that specific note are sent to our serverless Cloudflare Worker API to store the share payload.
• Deletion & Revocation: You can delete or update any active share link at any time directly through the Share dialog inside the application.
• No Account Linking: Shared notes are identified by randomized cryptographic tokens and are not tied to your identity.

5. In-Browser Code Execution Sandbox

DevNotes features an in-browser code runner for executing JavaScript and HTML:

• Code is executed locally within isolated client-side sandboxes (sandboxed iframes).
• Your code and execution outputs are never forwarded to external remote code execution backends.

6. Offline Functionality and Service Workers

DevNotes uses a Service Worker to cache static assets (HTML, CSS, JavaScript, icons, and fonts) on your device. This allows the application to load instantly and operate without an internet connection. The Service Worker does not transmit note data to any remote location.

7. Third-Party Resources

To provide high-quality typography and rendering, DevNotes requests fonts from Google Fonts. Google's privacy policy governs any requests made to their font delivery network.

8. Data Portability and Deletion

You can manage and export your data at any time:

• Export All Notes: Use the "Export All Notes (JSON)" function in the sidebar to download an unencrypted archive of all your notes and folder structure.
• Export Individual Notes: Export any note as a Markdown (.md) file or printable PDF.
• Clear All Data: Use the "Reset Defaults" button in Settings or clear your browser site data to wipe all local notes.

9. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Any changes will be reflected with a revised "Last Updated" date at the top of this page.

10. Contact

If you have any questions or feedback regarding this Privacy Policy, please open an issue on our GitHub repository or contact the project maintainers.