This policy explains what personal data Bricknote ("we", "us") collects, why, and the rights you have over it. The operator of Bricknote - and the controller of this data under the EU General Data Protection Regulation (GDPR) - is identified under Contact at the end of this page.
Data we collect
- Account data. Your email address. If you sign in with Google, we also receive the name and profile picture from your Google account.
- Your content. The notes, projects, templates, workspaces, and favorites you create. We store this to provide the service and for no other purpose.
- Billing data. Payments are handled by Paddle (see below). We receive your subscription status, plan, and country - we never see or store your card details.
- Technical data. Standard server logs (IP address, browser user agent, timestamps) kept for security and debugging.
- Optional analytics data. If you allow analytics, Google Analytics receives a pseudonymous account identifier when you are signed in, generalized page categories, product milestones, campaign parameters, browser and device information, and approximate location derived from your IP address. We do not send note content, note or workspace names, email addresses, search text, invitation tokens, or sign-in tokens.
Why we process it
- To perform our contract with you - creating your account, storing and syncing your notes, sending sign-in links and workspace invitations, managing your subscription.
- For our legitimate interests - keeping the service secure and preventing abuse.
- With your consent - understanding aggregate website and product usage through Google Analytics so we can improve Bricknote. You can decline or withdraw this consent at any time without affecting your account.
- To comply with legal obligations - tax and accounting records related to paid subscriptions.
We do not sell your personal data, and we do not show ads.
Who we share it with
We share data only with the service providers we need to run Bricknote, and only to the extent required:
- Paddle (Paddle.com Market Ltd, UK / Paddle.com Inc., US) - our merchant of record. Paddle processes payments and handles billing data under its own privacy policy.
- Resend - delivers our transactional email (sign-in links, invitations, billing notices).
- Google - only if you choose to sign in with Google.
- Google Analytics - only if you allow analytics. Google processes the optional analytics data described above on our behalf under its data-processing terms.
- Railway (Railway Corporation, US) - hosts our servers and database.
International transfers
Some of the providers above process data in the United States. Where data leaves the European Economic Area, the transfer is protected by the EU-US Data Privacy Framework or the European Commission's Standard Contractual Clauses.
Retention and deletion
We keep your data for as long as your account exists. You can export everything from your account settings at any time, and you can delete your account yourself - deleting your account immediately removes your account and content from the live service, and any residual copies in routine backups are cleared as those backups age out. Notes you created in a shared workspace owned by someone else stay in that workspace for its owner. Billing and accounting records are kept for as long as Czech tax and accounting law requires (generally up to 10 years).
Google Analytics user-level and event-level data is retained for up to 14 months and is not extended when you return. Aggregated reports may remain after that period. You can ask us to delete analytics data associated with your pseudonymous account identifier by emailing the address below.
Your rights (GDPR)
You can ask us for access to, correction of, or deletion of your personal data, ask for a portable copy, and object to or restrict certain processing. Email [email protected] and we will respond within a month. You also have the right to lodge a complaint with a supervisory authority - in the Czech Republic that is the Office for Personal Data Protection (ÚOOÚ), or you can contact the authority in your own country.
US state privacy rights
If you live in a US state with a consumer privacy law (such as California), you have similar rights to access, delete, and obtain a copy of your personal information. We do not sell or share personal information as those laws define it. To exercise these rights, use the same contact below.
Cookies
Bricknote always sets essential first-party cookies for your session and security. Google Analytics is not loaded and sets no analytics cookies unless you select "Allow analytics." If allowed, Google Analytics sets first-party _ga cookies to distinguish consented browsers. Your choice is saved in local browser storage. Use the control below or the Privacy section of your account page to change it; withdrawing consent stops analytics and removes Bricknote's Google Analytics cookies from that browser.
Children
Bricknote is not directed at children and is intended for users aged 16 or older. We do not knowingly collect data from children.
Changes to this policy
If we change this policy, we will update the date at the top, and for material changes we will notify you by email. See also our Terms of Service and Refund Policy.
Contact
Bricknote is operated by Serhii Volkov, a self-employed individual (OSVČ) registered in the Czech Republic, identification number (IČO) 24869449, with registered address Mozartova 3337/14, 150 00 Praha 5. For the purposes of the GDPR, this is the controller of the personal data described in this policy.
Questions about privacy or your data: [email protected].