Privacy Policy — DRAFT, NOT YET REVIEWED

This is a draft and does not bind anybody. It was written alongside the code so that its technical claims are accurate, which is the half a lawyer cannot check without reading the source. The rest — jurisdiction, retention periods, the wording of data-subject rights — needs review by someone qualified before it is published or relied on.

Every technical claim below is derived from docs/security-model.md, which is written to be checked against the client. If this document and that one ever disagree, that one is right and this is the bug.

Nerchure Ltd, a company registered in England and Wales, operating Nectenda.

The short version

Your notes are encrypted on your device before they reach us, with a key derived from a password we never receive. We cannot read your notes, your note titles, your folder names or your attachment filenames. We can see that you have an account, who you share folders with, how much data you store, and when you were connected.

We cannot recover your notes if you lose both your password and your recovery key. That is not a policy choice; there is no mechanism by which we could.

What we hold

Identity records. Your verified email address, your display name, the opaque subject id of any sign-in provider you link (Google, Apple, Microsoft), the public half of any passkey you register, which organisations you belong to and your role in each, and a record of each device you have signed in from. Your email is used to sign you in and to reach you about the service — invitations, licences, billing, security notices — and, if you consent separately, nothing else.

Not your passphrase, in any form. On the hosted service the passphrase that encrypts your notes is never sent to us, and neither is anything derived from it. We store your public key, your private key sealed under a key derived from your passphrase, and your master key sealed under your recovery key. All three are opaque to us. Share links and invitations are stored as hashes only.

Sign-in providers. If you sign in with Google, Apple or Microsoft, that provider learns that you signed in to Nectenda and tells us your email address and an opaque identifier. They are involved in the sign-in step and nothing else; they never see your notes or your passphrase.

The sharing graph. Which accounts share which folders, each member's role, and when they were added. We can see that two people share a folder. We cannot see what the folder is called or what is in it.

Devices. A device identifier, an optional label you choose, the platform string, and first- and last-seen times.

Sizes and timing. The byte length and arrival time of every update, the encrypted size of every attachment, and your account's storage total. This is enough to infer that a document is being actively edited and roughly how large it is. End-to-end encryption does not hide traffic patterns, here or anywhere.

Network information. IP addresses and connection times, as any service sees.

Payment records, if you buy something — handled by our payment provider. We receive a record of the transaction; we do not receive or store your card details.

What we do not hold, and could not produce

Note content, note titles, folder names, attachment filenames, and your password. Document identifiers on our servers are HMACs of paths, not paths. Attachment bytes are encrypted before upload and their filenames never leave your device.

If we were compelled to hand over everything we have, that is the list. It does not include anything you have written.

Where it lives

There is no hosted service yet. No sync server is running, and we are therefore holding nobody's data. This section describes what will be true when the hosted service opens, and it is published in advance so that it can be read before anyone has to decide whether to trust it — not because it is already in effect.

When it opens, your organisation's data lives in the region its owner chose:

Each storage provider receives ciphertext and opaque identifiers, and can see object sizes and access times. Your identity record and key material are held on our own servers in Germany whichever region your organisations are in. Email is handled on our own infrastructure, which is running today.

Error tracking. Our servers report unexpected errors to an error-tracking service we run ourselves, on our own infrastructure, not a third party. A report carries technical details of the error and account or folder identifiers so that we can act on it; it never carries note content, paths, folder or attachment names, tokens, passphrases or key material, and we test that rule rather than trust it. Reports are kept for a limited period and then deleted.

Service status. We publish the up-or-down state of our servers on a public status page. It shows server names and uptime, never anything about you.

Being encrypted does not remove our obligations, and it does not mean the metadata above is unimportant. It means the content is not ours to disclose.

How long

Account and sharing records are kept while the account exists. Deleted documents are retained briefly so that other devices can learn of the deletion, then removed. Unreferenced attachments are removed after a grace period. Backups are kept for a limited period and then rotated out.

Specific retention periods are deliberately left blank pending review, because a number invented here would be a promise nobody had checked against what the code does.

Your rights

Under UK and EU data protection law you can ask for a copy of what we hold, correct it, delete it, or object to how it is used. Write to privacy@nectenda.com.

One honest limitation. A copy of "everything we hold about you" is the metadata described above plus your encrypted blobs. We cannot provide your notes in readable form, because we cannot read them. Export your notes from Obsidian, where they are plain files on your disk.

Changes

If this changes materially we will say so by email before it takes effect.