Privacy Policy

Serene Notes is a free notes app, run as a private, non-commercial project. This page explains which personal data it handles, why, and what you can do about it. In short: it only keeps what it needs to run the app. There are no ads, no analytics and no tracking, and your data is never sold or shared for marketing.

Who is responsible

Jakob Gschwendtner
Hartkirchen, Austria
Email: jakobgschwendtnerdev@gmail.com

One account for Wyvern.one apps

Your account is a Wyvern.one account. Every Wyvern.one app is run by the same person named above and signs you in with it. Right now Serene Notes is the only one. When another app joins, it will be listed here, and it will only see your account details (name, email address, profile picture), not your notes. Deleting your account deletes it for every Wyvern.one app.

What is stored, and why

Your account. When you sign in with Google, the app receives your name, email address, profile picture and Google account ID. Google's sign-in tokens are stored encrypted. This is needed to give you an account (Art. 6(1)(b) GDPR).
Sign-in sessions. Each session stores your IP address and your browser (user agent), to keep you signed in and to spot misuse of your account (Art. 6(1)(b) and (f) GDPR).
Your notes, in built-in storage. Notes, folders, earlier versions of notes and recently deleted notes are stored in the app's database (Art. 6(1)(b) GDPR).
Your notes, in Dropbox. If you choose Dropbox storage, your notes and images stay in your own Dropbox. The app passes them through its server when you open and save them, but doesn't keep them. It stores your Dropbox tokens encrypted, and, for version history, details about each saved version (file and version IDs, size, word count and folder), not the text itself (Art. 6(1)(b) GDPR).
Server logs. The hosting provider briefly logs requests (time, address requested, IP address) to run the service and keep it secure (Art. 6(1)(f) GDPR).
Emails you send. If you write to the contact address, your email address and message are kept as long as needed to answer, and requests about your data for 3 years, to show they were handled (Art. 6(1)(c) and (f) GDPR). The address is a Gmail account, so these emails are stored by Google.

Cookies and storage in your browser

The app sets only the cookies it needs to work: your sign-in session and your display preferences (light or dark mode, whether the sidebar is collapsed). These need no consent (§ 165(3) TKG 2021). To open notes quickly and keep unsaved edits safe, it also keeps copies of your notes, their names and your preferences in your browser's storage. Signing out or deleting your account removes the notes and their names from that browser.

Images from other websites

A note can show images that are hosted on other websites. They only load once you allow that website. Your browser then fetches them directly from it, so that website sees your IP address.

Services the app uses

Vercel Inc. (USA) hosts the app.
Databricks, Inc. (USA), the company behind Neon, hosts the database, on servers in Frankfurt, Germany.
Google Ireland Limited provides the sign-in. Google's own privacy policy applies to your Google account.
Dropbox International Unlimited Company (Ireland) stores your notes, only if you choose Dropbox storage. Dropbox's own privacy policy applies to your Dropbox account.

Data that goes to the USA relies on the EU-US Data Privacy Framework, which Vercel and Databricks are both certified under.

How long data is kept

Your account and notes are kept until you delete them. Deleting your account in Settings removes everything the app stores about you right away.
Deleted notes and folders stay in Recently deleted for 30 days.
Earlier versions of a note are kept for 30 days. Versions you name are kept until you delete the note.
Sign-in sessions end when you sign out, or after 7 days without a visit.
Server logs are kept for 1 hour.
The database host keeps 6 hours of history to restore the database from, so deleted data is fully gone 6 hours after it's deleted.
Files in your Dropbox are yours. The app never deletes them unless you delete them in the app, and you can revoke the app's access in your Dropbox settings at any time.

Your rights

You have the right to access your data, to have it corrected or deleted, to restrict or object to its processing, and to get it in a portable format (Settings → Export gives you all your notes as a zip). Email jakobgschwendtnerdev@gmail.com for any of these. You can also complain to the Austrian Data Protection Authority (Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna, dsb.gv.at).

Your right to object. Sign-in sessions and server logs are based on a legitimate interest: keeping your account and the app secure. You can object to this at any time, for reasons arising from your particular situation, by emailing jakobgschwendtnerdev@gmail.com. The processing then stops, unless there are compelling legitimate grounds for it that outweigh your interests, or it is needed to establish, exercise or defend legal claims (Art. 21 GDPR).

Your data isn't used for automated decisions or profiling. You don't have to provide any of it, but without a Google sign-in you can't use the app.

Changes

This policy changes when the app does. The date below shows the last change. Last updated: 30 October 2026.