Privacy Policy — DRAFT, NOT YET REVIEWED

This is a draft and does not bind anybody. It was written alongside the code so that its technical claims are accurate, which is the half a lawyer cannot check without reading the source. The rest — jurisdiction, retention periods, the wording of data-subject rights — needs review by someone qualified before it is published or relied on.

Every technical claim below is derived from docs/security-model.md, which is written to be checked against the client. If this document and that one ever disagree, that one is right and this is the bug.

Nerchure Ltd, a company registered in England and Wales, operating Nectenda.

The short version

Your notes are encrypted on your device before they reach us, with a key derived from a password we never receive. We cannot read your notes, your note titles, your folder names or your attachment filenames. We can see that you have an account, who you share folders with, how much data you store, and when you were connected.

We cannot recover your notes if you lose both your password and your recovery key. That is not a policy choice; there is no mechanism by which we could.

What we hold

Account records. Your username, your email address, your account, plan and role, and when the account was created. Your email is used to reach you about the service — licences, billing, security notices — and, if you consent separately, nothing else.

Authentication material. Not your password. The client derives a value from your password and sends that; we store a bcrypt hash of it. We also store your public key, your private key sealed under a key derived from your password, and your master key sealed under your recovery key. All three are opaque to us.

The sharing graph. Which accounts share which folders, each member's role, and when they were added. We can see that two people share a folder. We cannot see what the folder is called or what is in it.

Devices. A device identifier, an optional label you choose, the platform string, and first- and last-seen times.

Sizes and timing. The byte length and arrival time of every update, the encrypted size of every attachment, and your account's storage total. This is enough to infer that a document is being actively edited and roughly how large it is. End-to-end encryption does not hide traffic patterns, here or anywhere.

Network information. IP addresses and connection times, as any service sees.

Payment records, if you buy something — handled by our payment provider. We receive a record of the transaction; we do not receive or store your card details.

What we do not hold, and could not produce

Note content, note titles, folder names, attachment filenames, and your password. Document identifiers on our servers are HMACs of paths, not paths. Attachment bytes are encrypted before upload and their filenames never leave your device.

If we were compelled to hand over everything we have, that is the list. It does not include anything you have written.

Where it lives

Servers in Germany, currently hosted by Hetzner. Attachments may be stored with an object-storage provider; that provider receives ciphertext and opaque identifiers, and can see object sizes and access times. Email is handled on our own infrastructure.

Being encrypted does not remove our obligations, and it does not mean the metadata above is unimportant. It means the content is not ours to disclose.

How long

Account and sharing records are kept while the account exists. Deleted documents are retained briefly so that other devices can learn of the deletion, then removed. Unreferenced attachments are removed after a grace period. Backups are kept for a limited period and then rotated out.

Specific retention periods are deliberately left blank pending review, because a number invented here would be a promise nobody had checked against what the code does.

Your rights

Under UK and EU data protection law you can ask for a copy of what we hold, correct it, delete it, or object to how it is used. Write to privacy@nectenda.com.

One honest limitation. A copy of "everything we hold about you" is the metadata described above plus your encrypted blobs. We cannot provide your notes in readable form, because we cannot read them. Export your notes from Obsidian, where they are plain files on your disk.

Changes

If this changes materially we will say so by email before it takes effect.