This policy explains what personal data Bricknote ("we", "us") collects, why, and the rights you have over it. The operator of Bricknote - and the controller of this data under the EU General Data Protection Regulation (GDPR) - is identified under Contact at the end of this page.
Data we collect
- Account data. Your email address. If you sign in with Google, we also receive the name and profile picture from your Google account.
- Your content. The notes, projects, and workspaces you create. We store this to provide the service and for no other purpose.
- Billing data. Payments are handled by Paddle (see below). We receive your subscription status, plan, and country - we never see or store your card details.
- Correspondence. Emails you send us or reply to us with, and the address they come from.
- Technical data. Standard server logs (IP address, browser user agent, timestamps) kept for security and debugging.
- Visit statistics. Cloudflare Web Analytics counts page views, referring sites, and page load performance on bricknote.io. It sets no cookies, does not identify or follow you across sites, and gives us only aggregate numbers.
- Signup source. If the link that brought you to Bricknote carried campaign tags (such as
utm_source=reddit), we save those tags on your account when you sign up, so we know which posts and sites bring people in. This does not involve Google Analytics and does not depend on your analytics choice. - Optional analytics data. If you allow analytics, Google Analytics receives a pseudonymous account identifier when you are signed in, generalized page categories, product milestones, campaign parameters, browser and device information, and approximate location derived from your IP address. We do not send note content, note or workspace names, email addresses, search text, invitation tokens, or sign-in tokens.
Why we process it
- To perform our contract with you - creating your account, storing and syncing your notes, sending sign-in links and workspace invitations, managing your subscription.
- For our legitimate interests - keeping the service secure, preventing abuse, counting which links bring in new accounts, measuring aggregate site traffic and performance with Cloudflare Web Analytics, answering your emails, and occasionally writing to ask how Bricknote is working for you. Tell us you'd rather not hear from us and we'll stop.
- With your consent - understanding aggregate website and product usage through Google Analytics so we can improve Bricknote. You can decline or withdraw this consent at any time without affecting your account.
- To comply with legal obligations - tax and accounting records related to paid subscriptions.
We do not sell your personal data, and we do not show ads.
Who we share it with
We share data only with the service providers we need to run Bricknote, and only to the extent required:
- Paddle (Paddle.com Market Ltd, UK / Paddle.com Inc., US) - our merchant of record. Paddle processes payments and handles billing data under its own privacy policy.
- Resend - delivers our transactional email (sign-in links, invitations, billing notices).
- Email provider - hosts our mailbox. If you email us or reply to us, your message and email address are stored there.
- Google - only if you choose to sign in with Google.
- Google Analytics - only if you allow analytics. Google processes the optional analytics data described above on our behalf under its data-processing terms.
- Cloudflare (Cloudflare, Inc., US) - every request to bricknote.io passes through Cloudflare's network, which delivers and protects the site and provides the cookieless visit statistics described above.
- Railway (Railway Corporation, US) - hosts our servers and database.
International transfers
Some of the providers above process data in the United States. Where data leaves the European Economic Area, the transfer is protected by the EU-US Data Privacy Framework or the European Commission's Standard Contractual Clauses.
Retention and deletion
We keep your data for as long as your account exists. You can export everything from your account settings at any time, and you can delete your account yourself - deleting your account immediately removes your account and content from the live service, and any residual copies in routine backups are cleared as those backups age out. Notes you created in a shared workspace owned by someone else stay in that workspace for its owner. Billing and accounting records are kept for as long as Czech tax and accounting law requires (generally up to 10 years). Emails you send us are kept for as long as we need them to answer you and keep a record of the conversation.
Google Analytics user-level and event-level data is retained for up to 14 months and is not extended when you return. Aggregated reports may remain after that period. You can ask us to delete analytics data associated with your pseudonymous account identifier by emailing the address below.
Your rights (GDPR)
You can ask us for access to, correction of, or deletion of your personal data, ask for a portable copy, and object to or restrict certain processing. Email [email protected] and we will respond within a month. You also have the right to lodge a complaint with a supervisory authority - in the Czech Republic that is the Office for Personal Data Protection (ÚOOÚ), or you can contact the authority in your own country.
US state privacy rights
If you live in a US state with a consumer privacy law (such as California), you have similar rights to access, delete, and obtain a copy of your personal information. We do not sell or share personal information as those laws define it. To exercise these rights, use the same contact below.
Cookies
Bricknote always sets essential first-party cookies for your session and security. Until you sign up, the session cookie can also hold the campaign tags of the link you arrived from; signing in clears them from the cookie. Google Analytics is not loaded and sets no analytics cookies unless you select "Allow analytics." Cloudflare Web Analytics sets no cookies and does not depend on this choice. If allowed, Google Analytics sets first-party _ga cookies to distinguish consented browsers. Your choice is saved in local browser storage. Use the control below or the Privacy section of your account page to change it; withdrawing consent stops analytics and removes Bricknote's Google Analytics cookies from that browser.
Children
Bricknote is not directed at children and is intended for users aged 16 or older. We do not knowingly collect data from children.
Changes to this policy
If we change this policy, we will update the date at the top, and for material changes we will notify you by email. See also our Terms of Service and Refund Policy.
Contact
Bricknote is operated by Serhii Volkov, a self-employed individual (OSVČ) registered in the Czech Republic, identification number (IČO) 24869449, with registered address Mozartova 3337/14, 150 00 Praha 5. For the purposes of the GDPR, this is the controller of the personal data described in this policy.
Questions about privacy or your data: [email protected].