Privacy Policy

Article 1 (Personal Information Collected)

If you use the app without signing in — the Company collects no personal information (if you have turned on anonymous usage statistics, the item below applies). It asks for no sign-up and no login.

• What you write — notes, tasks, events, reminder times and so on — is stored only on your own device.
• Reading your sentence and filing it as a note, task, or event is performed entirely on the device. The text you type is not sent to the Company or to any third-party server (with one exception: if you turn on link previews below, the app requests the address written in your note). The judgement is made by rules on the device; no external language model is called.
• Reading text out of photos, screenshots and scanned documents (OCR), and turning voice recordings into text (transcription) are likewise performed entirely on the device, using Apple's on-device recognition. Photos, recordings and recognition results are not sent to the Company or to any third-party server, and the feature is not offered for languages that have no on-device model.
• The camera is used only for document scanning, and captured images are stored on the device as note attachments. The microphone is used only for voice recording.
• The Company uses no analytics SDK, no advertising SDK, and no advertising identifier (IDFA). Crash reporting in the app (Firebase Crashlytics) runs only if you turn on the anonymous usage statistics below; it is off by default. The website carries no analytics or advertising scripts either. The analytics feature of the provider that delivers our web pages (Cloudflare) is switched off (15 September 2026), and the site's Content Security Policy blocks such scripts from running in any case.
• The Company does not collect or store your contact details, location, address book, or advertising identifier.
• Anonymous usage statistics — only if you turn them on under Settings → About in the app. Once a week the app sends counts of how often features were used (lines written and how they were filed, corrections, widget and share entries, paywall views and purchases by plan), the app version, iOS version, language setting, and a random per-installation identifier to the Company's server (Cloud Storage on Google Firebase). Note text, titles, account details and location are never included. Turning it off also deletes the counts kept on the device; statistics already sent cannot identify you.
  The same setting also turns on crash reporting. With it on, technical details of an abnormal termination (where the error occurred, device model, iOS and app version) and app launch records (launch time, installation identifier) may be sent to Google Firebase (Crashlytics). Note text, titles and account details are never included, and turning the setting off deletes reports not yet sent from the device.
• Link previews (only if you turn them on in the app's settings; off by default) — when a paragraph in a note is just a link, the app requests that site directly to show the page's title and image. The request does not pass through the Company's servers, and the Company does not know which links were requested. The site receives what it would receive if you opened the link in a browser (IP address, device and browser details, the requested address), and its own policy applies. The fetched title and image are stored only on your device and are deleted when you turn the feature off.
• Opening a note that contains maths or a diagram — in the app, opening a note with maths ($…$) or a diagram (mermaid) downloads the public libraries that draw them (KaTeX and Mermaid) from an external distributor (jsDelivr). Note content is not sent; what is fetched is the same static file everyone receives. The distributor does receive ordinary request information such as your IP address. The web (oneline.date) ships these libraries with the page, so it makes no such request.

If you sign in and turn on sync — the following is stored on the Company's servers. Signing in is optional; if you never do, none of it is collected.

• What you write — the body, title, tags, dates and times of your notes, tasks and events, together with the deletion markers that keep a deleted item from coming back on another device.
• Photos, voice recordings and files you attach to a note — attachments you upload on the web, and attachments added in the app (version 1.7.8 or later), are stored on the Company's servers whatever your plan, up to 5 GB per account, once you sign in. Attachments a free user added in app version 1.7.7 or earlier stayed on the device; they are uploaded when the app is updated to 1.7.8 or later and opened.
• Account details — the name and email address that Sign in with Apple, or Google sign-in, passes to the Service. If you choose Apple's “Hide My Email”, the Company only ever receives the relay address.
• An account identifier — a random string used to tell whose writing is whose (a Firebase user ID).
• An installation identifier — a random string the sync SDK creates per app installation. The Company does not read or use it directly, and it is never used for advertising or tracking.
• Subscription entitlement — to decide whether to enable paid features, we store whether a subscription is valid, when it expires, and the transaction identifier of the purchase. The transaction identifier is used only to match App Store payment notifications to the right user. The Company never receives your payment method, card number, or amounts paid.

If you use the web (oneline.date) — once you sign in, the web uses the same account and the same servers as above. The things that arise on the web alone are these.

• If you use it without signing in — the web lets you write, edit and delete without an account. What you write that way is stored only in your browser's local storage and is never sent to the Company's servers; the Company cannot read it. If you later sign in, it is moved into your account and then removed from the browser. Clearing the site's data removes anything not yet moved.
• Read-only share links — only when you pick a note and choose “Create a read-only link”, a single copy of that note (its title and body) is stored in a Cloudflare database and published at oneline.date/s/…. Anyone who knows the address can read it without signing in. Search engines are asked not to index it, but that does not change the fact that the address opens for anyone who has it. The note's attachments go with it (from 18 September 2026) — the files themselves stay in the storage named in Article 1, Cloudflare's database holds only the address that points at each file plus its name, type and size, and Cloudflare fetches the file from that address when a reader opens it. A link carries up to 25MB per file, 100MB and 20 files in all; anything over that is left out, and the screen tells you how many when you create the link. Revoking the link deletes the copy immediately, and both the address and its attachments stop opening. If you never share, nothing is stored this way. See Articles 3 and 3-2.
• Storage inside your browser — your signed-in state, a copy of the notes you have recently opened, and display settings (view mode, drawer width) are kept in the browser's own storage (local storage and IndexedDB), so that what you write is not lost when the network drops. That copy never leaves your browser. Signing out, or clearing the site's data in your browser, removes it. On the web sign-in page, Google draws the Google button itself. Opening the sign-in page therefore loads Google's script, and if this browser is signed in to Google, Google shows that account's name and picture inside the button. That happens between Google and your browser; the Company does not receive it, and no account information reaches the service until you press the button. The script is loaded on the sign-in page only.
• Signing in with the One Line app (QR) — when you press "Sign in with the One Line app" on the sign-in page and a QR code is shown, that one request is kept on the Company's server (Google Firebase Cloud Firestore, Seoul) for at most two minutes. It holds the names of your browser and operating system (for example Chrome, Windows), the time the request was made, a two-digit confirmation number, a hash of a secret that only your browser knows, and an approximate location (from 16 October 2026; a city and country name such as "Seoul, South Korea"). The location is only the name of the place Cloudflare's server estimated from the connection address; the IP address itself, an exact position and account information are not stored. When the One Line app on your iPhone reads the QR code, the app receives these items and shows them on its "Sign in to this browser?" screen (the location as "near …, approximate and may be wrong"); if you approve, the web is signed in with the account signed in to the app. Helping you tell whether the request is your own is the only use of these items. The request is deleted once the approval is used or two minutes pass. If you never show a QR code, nothing is stored.
• Web usage counts (can be turned off in Settings) — the web collects how often features are used as daily counts only: the number of browsers visiting for the first time, the time it took to write the first note (in bands: 10 seconds · 30 seconds · 1 minute · 5 minutes · longer), the number returning 7–13 days after the first visit, and the number of exports. These counts contain no account, IP address, value that could single out a device or browser, or note content, and one person's use cannot be linked to another. The first-visit date and the “already sent” marks are stored only in your browser and are never sent to the Company. The counts are stored in Cloudflare's database (Article 3-2). Nothing is sent if you turn off Settings → Privacy & safety → “Send usage counts”, or if your browser sends Global Privacy Control. The number of shared links created is not collected separately; it is counted from the dates of the shared-link copies above.
• Access logs — delivering the web pages leaves your IP address, the time of the request, and your browser type in the logs of the delivery provider (Cloudflare). They are used only to operate the service and to investigate faults, never to identify or profile you.
• The Company uses no advertising or tracking cookies. Nothing is sold on the web, so no payment details are received there.

The Company never receives your Apple or Google account password. Authentication is performed by Apple and Google, and only the result is passed to the Company.

If you choose to email manager@x-ti.org directly, your email address and the contents of your message reach the Company only to the extent needed to answer you. That is information you send voluntarily, not information the Service collects.

Article 2 (Purpose of Processing)

The Company processes personal information only for the purposes below and never beyond them. It is never used for advertising, profiling, user tracking, or sale to third parties.

• Providing sync between devices — only if you sign in, your writing and attachments are kept so that you can carry on from another device or the web, and after reinstalling. Account details are used solely to determine whose writing is whose.
• Providing paid features — checking your subscription entitlement in order to turn paid (Pro) features on and off. Cloud storage of attachments and use of the web are provided whatever your plan, so they do not depend on the entitlement.
• Improving the service — web usage counts (Article 1) are used only to understand which features are used. They do not single anyone out and are not combined with other information.
• Responding to inquiries — an email you send is used only to reply to you, and is not used for any other purpose once the matter is resolved.
• Subscription management — payment, renewal, and refunds for the paid subscription are handled by Apple, and the Company only checks whether a subscription is active. Nothing is sold on the web.

Article 3 (Provision to Third Parties and Outsourcing)

The Company does not sell your personal information or share it with third parties for marketing. It outsources processing only as far as needed to run the service:

• Google LLC (Firebase) — handling of sign-in (Firebase Authentication), storage and sync of your writing (Cloud Firestore), and storage of attachments and anonymous usage statistics (Cloud Storage). The scope is everything listed under “If you sign in and turn on sync” in Article 1, plus the anonymous usage statistics if you have turned them on. Your writing and subscription entitlement are held in the Seoul region of Google Cloud (asia-northeast3), in the Republic of Korea; attachments and anonymous usage statistics are held in the asia-east1 region (Taiwan) of Cloud Storage. If you neither sign in nor turn on usage statistics, no such outsourcing occurs.
• Apple Inc. — distribution through the App Store and payment for the paid subscription. Payment information is handled between you and Apple and is not passed to the Company.
• Cloudflare, Inc. — delivery of the oneline.date web pages, handling of the domain, and storage of the copy of any note you choose to share (read-only share links; the copy includes the addresses that point at that note's attachments, and Cloudflare fetches and delivers those files when a reader opens them). Page delivery leaves access logs (IP address, request time, browser type). Apart from notes for which you created a share link yourself, what you write is not stored on this path — the rest lives only on the servers named in Article 1 (Google Firebase), and Cloudflare merely delivers pages. The copy of a shared note is held in Cloudflare's database in the Republic of Korea (Seoul) (measured 15 September 2026).

Apple's and Google's handling of personal information is governed by their own privacy policies.

Article 3-2 (Transfer of Personal Information Overseas)

What you write is not transferred overseas. Even when you sign in and turn on sync, your writing and subscription entitlement are held in the Seoul region of Google Cloud (asia-northeast3), in the Republic of Korea, and the copy made for a read-only share link is held in Cloudflare's database in the Republic of Korea (Seoul). Web usage counts (Article 1 — daily counts without identifiers) are in the same database.

Attachments (photos and voice recordings) and anonymous usage statistics, however, are held in the asia-east1 region of Google Cloud Storage, which constitutes a transfer overseas.

• Recipient — Google LLC (Firebase)
• Country — Taiwan (Google Cloud asia-east1)
• When and how — at the moment you upload an attachment, over the network (HTTPS)
• Items transferred — photos, voice recordings and files attached to notes; anonymous usage statistics and the installation identifier
• Purpose — storing attachments and aggregating usage statistics
• Retention period — until you delete your account

Uploading an attachment while signed in causes this transfer whatever your plan (on the web, and in app version 1.7.8 or later). If you do not sign in or do not attach files, no attachment transfer occurs. Usage statistics can be turned off under Settings → About in the app.

The name, email address and account identifier used to sign you in are handled by Firebase Authentication. No region can be selected for these items, so they are processed in Google data centres including those in the United States.

• Recipient — Google LLC
• Country — the United States and other countries where Google operates data centres
• When and how — at the moment you sign in, over the network (HTTPS)
• Items transferred — name, email address, account identifier
• Purpose — handling sign-in
• Retention period — until you delete your account

If you turn on Hide My Email when signing in with Apple, an @privaterelay.appleid.com address is passed to the service instead of your real email address. In that case the Company never learns the real address.

Simply opening a web page causes the following transfer.

• Recipient — Cloudflare, Inc.
• Country — the United States and Cloudflare's edge servers in various countries
• Items transferred — IP address, request time, browser type
• Purpose — delivering the web pages and investigating faults
• Retention period — Cloudflare's log retention period

You may refuse this transfer. There are three transfers, and each is refused in a different way.

• Sign-in information — both the app and the web can be used without signing in, and no such transfer occurs then. Without signing in there is no sync between devices, and anything written on the web stays in that browser.
• Attachments — if you upload no attachments, on the web or in the app, no such transfer occurs. Writing text alone still works, and your writing is held in the Seoul region and is not transferred overseas.
• Anonymous usage statistics — turn them off under Settings → About in the app. The web collects no usage statistics.

Information already stored on the server can be removed with Settings → Account on the web, or Settings → Account → Delete account in the app. Refusing does not affect any on-device feature of the app.

Article 4 (Retention and Destruction)

If you have signed in, the Company keeps your writing until you delete it yourself. It does not set a retention period and does not delete anything on its own initiative.

• Tapping Settings → Account → Delete account in the app, or Settings → Account on the web, deletes your account and everything stored on the server (notes, attachments, the trash, and the copies behind any share links) immediately and irreversibly. Your Apple and Google sign-in links are revoked at the same time.
• Switching the storage location to “This device only” or “Back up to a file” stops anything further from being uploaded. To remove what is already there, use Delete account above.
• What you enter in the Service is stored on your device and is deleted along with the app when you delete it. If you were signed in, the copy on the server remains until you delete your account.
• What you delete stays in the trash for 14 days. Deleting a note removes it from the screens of your other devices at once, but one copy is kept on the Company's servers (the Cloud Firestore of Article 1, Seoul region) for 14 days so that it can be restored. After that a clean-up job that runs once a day on the Company's servers deletes that copy and any attachment that only it referred to. Because it runs once a day, a copy may remain for up to one more day past the 14th. You can empty it sooner under Menu → Trash on the web. Deleting your account deletes the trash with it.
• From version 1.7 of the app (iOS), what you delete in the app is kept in the same trash. Until then this copy was made only for deletions on the web, and a deletion in the app removed the note from the server at once. On 1.7 and later, a deletion in the app also leaves a 14-day copy in the same place (the trash under the same account), so it can be restored from either side; the period and the clean-up job are as above. While you are on app 1.6 or earlier, deleting in the app leaves no copy.
• The copy behind a share link is kept until you revoke it. No period is set and nothing is deleted on its own initiative.
• Signing out on the web clears the copy left in your browser. Anything written without signing in disappears when you clear the site's data.
• Backup files you export are kept and deleted by you.
• Web usage counts are destroyed after 25 months. Being daily counts, the rows for a date are deleted as a whole, by a job that runs once a day on the Company's server.
• Inquiry emails are destroyed within three years of the reply being sent.

Article 5 (Your Rights)

You can view, edit, and delete your own data at any time.

• Edit or delete any individual item directly, in the app or on the web.
• Use backup export to get all of your data as a file, and restore to bring it back. You can also export everything on the web under Settings → Data — as one JSON file, or as a zip in which each note is its own Markdown file. Markdown files exported from other apps can be imported as well.
• Deleting the app deletes the data stored on the device.
• Deleting your account and everything stored on the server is something you can do yourself in Settings → Account → Delete account in the app, or Settings → Account on the web. There is no request procedure and no waiting period.
• Share links can be revoked at any time under Settings → Data → Shared links on the web. The address stops opening immediately.
• You may also exercise your rights of access, correction, deletion and restriction of processing by writing to manager@x-ti.org, and the Company will act without delay.

Article 6 (Security Measures)

• On-device processing — the judgement that sorts your sentences happens on the device, and your text is not transmitted to a server for it.
• Optional collection — nothing at all is collected from users who do not sign in, including those writing on the web without an account (if you turn on anonymous usage statistics, the corresponding item in Article 1 applies).
• Encryption in transit — all communication, in the app and on the web, is over HTTPS end to end.
• Access control — server security rules mean each user's writing and attachments can be read and written only by that user's own account; no other user can reach them.
• Device protection — data stored on the device is protected by iOS file protection. We recommend keeping a device passcode, Face ID, or Touch ID enabled.
• Shared computers — the web leaves a copy in the browser, so we recommend signing out after using a shared computer. If you wrote without signing in there is no account to sign out of, so clear the site's data to remove that writing from that computer.

Article 7 (Children's Information)

The Service is not directed at children under the age of 14, and the Company does not separately collect or use children's personal information. Nothing at all is collected from users who do not sign in (if you turn on anonymous usage statistics, the corresponding item in Article 1 applies).

Article 8 (Data Protection Officer)

For questions, complaints, or remedies concerning the handling of personal information, please contact:

Data Protection Officer

Cho Seungkyu

Email

manager@x-ti.org

Company

XTI Co., Ltd. (주식회사 엑스티아이)

Business registration no.

362-87-03342

Corporate registration no.

130111-1216844

Address

2F, 94 Yangcheon-ro, Gangseo-gu, Seoul 07604, Republic of Korea

Article 9 (Duty of Notice)

If anything in this privacy policy is added, removed, or changed, the Company will announce it on this page at least seven days before the change takes effect. For changes that materially affect users' rights, notice will also be given by other means, such as an in-app announcement.

• 30 August 2026 — first effective
• 5 September 2026 — cloud backup items revised
• 7 September 2026 — clauses about iCloud sync were removed because the feature no longer exists, and the web (oneline.date) and Google sign-in were added. Later the same day, the overseas-transfer clause was corrected after the storage location of your writing was confirmed to be Seoul, Republic of Korea, and the Taiwan region holding attachments and anonymous usage statistics was set out as a transfer overseas.
• 8 September 2026 — What is held in Cloud Firestore was corrected from “account information” to subscription entitlement, and the overseas-transfer clause now states that Firebase Authentication, which handles the name, email address and account identifier, allows no region to be selected. A note about Apple's Hide My Email was added at the same time. Later the same day, the Article 1 sentence about using the app without signing in gained a parenthesis pointing at the anonymous usage statistics item, which had sat in a different clause. Later the same day, because the server now receives App Store payment notifications, the subscription entitlement item was extended to say that the transaction identifier of a purchase is stored — not a payment method or amount, but the number used to match a payment to the right user.
• 9 September 2026 — The web (oneline.date) became free to use in full, and the wording about attachments was corrected to match. Until now this policy said that keeping attachments in the cloud was a paid (Pro) feature and that no transfer overseas therefore occurred for free users. Attachments uploaded on the web are now stored on the Company's servers whatever your plan, so that sentence had stopped being true. Two places were corrected: the collected items in Article 1 and the overseas-transfer clause in Article 3-2. Keeping attachments added in the app in the cloud remains a paid (Pro) feature.
  This revision did not meet the seven days' notice set out in Article 9, because it took effect on the same day as the switch to a free web. Leaving the earlier sentence in place would have left the policy at odds with the facts, so the correction was published at once and the fact is recorded here.
  The same day, the ways of refusing the overseas transfer in Article 3-2 were rewritten. They had said only to use the app and not the web, which, now that the web is free, asks you not to use the service rather than to refuse a transfer. The three transfers are now set out separately, each with how it is refused, and it is stated plainly that the web only opens once you sign in, so the sign-in transfer cannot be avoided while you use it. That account deletion works on the web as well as in the app was added at the same time.
• 15 September 2026 — Three additions to the web made several sentences in this policy untrue. Each is set out here rather than quietly corrected.
  First, the web can now be used without signing in. This policy had said that “reading and writing on the web requires signing in” and that “the web only opens once you sign in, so the sign-in transfer cannot be avoided”. Neither is true any more: you can write without an account, and what you write that way stays in your browser and never reaches our servers. The change favours the user, but a policy that does not match the facts is wrong either way, so Articles 1, 3-2 and 6 were corrected.
  Second, read-only share links were added. When you choose to share one note, a single copy of it is stored in a Cloudflare database and anyone who knows the address can read it without signing in. This policy had said of Cloudflare that “what you write does not travel through this path” and, of overseas transfers, that “what you write is not transferred overseas”. For shared notes those two sentences became untrue, so the feature was added to Article 1, the outsourcing entry in Article 3 was corrected, and a new transfer was set out in Article 3-2. Nothing changes if you never share.
  Third, what you delete on the web now stays in a trash for 30 days. It used to be gone at once, so the retention period in Article 4 now says so. The copy sits in the same Seoul region as your writing, and deleting your account deletes it too.
  The same day we recorded in Article 1 that the provider delivering our web pages sometimes inserts its own analytics snippet. The Company blocks it with the site's Content Security Policy, so nothing is collected through it; but a policy that only says “no analytics scripts are placed on the web” would be lying to anyone who found that snippet in the page source. That everything can be exported from the web as well (Article 5), and the app's new App Store name, were reflected too.
  This revision also did not keep the seven days' notice. It takes effect the same day the features shipped. Leaving untrue sentences in place for a week seemed worse than correcting them at once and recording that fact here.
  Later the same day, three further points reported by the app side were reflected. All three were places where this policy had fallen behind the app; the app measured them and told us.
  One, crash reporting. The next app release (1.6) includes Firebase Crashlytics. This policy said the Company uses “no crash-reporting SDK”, so Article 1 would become untrue the moment that release shipped. That phrase was removed, and we wrote down that the same switch as the anonymous usage statistics also turns crash reporting on, together with what is sent. It is off by default, and turning it off deletes reports not yet sent from the device.
  Two, link previews. Already in 1.5, which is on sale now. Only for those who turn it on, and only when a paragraph in a note is just a link, the app requests that site directly. Article 1's “the text you type is not sent to the Company or to any third-party server” now carries that exception, and a new item describes it.
  Three, maths and diagrams. Opening a note with maths or a diagram in the app downloads the public libraries that draw them from an external distributor. Note content is not sent, but it is the one place where a third party receives your IP without any opt-in, so there was no reason not to say so.
  Articles 6 and 7, which said that nothing at all is collected from users who do not sign in, now point to the statistics item; and purchases in the statistics item are now counted by plan.
  Later the same night, three things this policy had called unknown that morning were actually checked.
  One, the copy of a shared note does not leave the country. That morning we did not know where Cloudflare places the database, so we wrote “the United States and other countries in which Cloudflare operates data centres” and set out an overseas transfer. On checking, it is in the Republic of Korea (Seoul). Declaring a transfer that does not happen is also a wrong declaration, so that entry was removed and the storage location was written into Articles 3 and 3-2. Writing broadly about something unknown felt safe, but writing broadly and writing accurately are not the same thing.
  Two, the storage location of attachments was confirmed. This policy has said Taiwan (asia-east1) since 7 September, but it had never actually been verified. The owner checked the console and confirmed ASIA-EAST1 — what was written was correct. The wording stands; only the fact that it is now verified is recorded here.
  Three, the delivery provider's analytics was switched off. That morning we wrote that it is sometimes inserted and that we block it with our security policy; the owner has now turned the feature off, and the script no longer reaches the page (verified in production). The security policy stays as it is — two guards are better than one.
  Four, the processing location for sign-in details was confirmed too. This policy has said that Firebase Authentication offers no region choice; the owner confirmed that the console has no data-location setting at all — what was written is correct. With that, every storage location this policy names is now a verified value.
• 16 October 2026 — current. An approximate location was added to the QR sign-in request.
  The app's approval screen now shows a city and country name, such as "near Seoul, South Korea", so that you can recognise a QR code someone else handed you (Article 1). Only the place name Cloudflare's server estimated from the connection address is kept, never the IP address itself, and it is deleted with the request after at most two minutes. Storage locations are unchanged.
  This revision also failed the seven-day notice. It takes effect on the day the feature ships.
• 7 October 2026 — "Sign in with the One Line app (QR)" is now open on the web sign-in page.
  From app version 1.8.0, the One Line app on your iPhone reads the web's QR code and approves the sign-in. For this, one sign-in request made by the web stays on the Company's server for at most two minutes, holding the browser and operating-system names, the time, a confirmation number and a hash of a secret (Article 1). No IP address, location or account information is stored, and the request is deleted once the approval is used or two minutes pass. The sign-in method and the storage location (Article 3-2) are unchanged.
  This revision also failed the seven-day notice. It takes effect on the day the feature opens, for the same reason as the earlier revisions.
• 29 September 2026 — Attachments added in the app are now kept in the cloud whatever your plan.
  From app version 1.7.8, free users' photos, recordings and files added in the app are uploaded too, up to 5 GB per account (the web has done this since 9 September). The sentence saying that cloud storage of attachments added in the app is a paid (Pro) feature was corrected in Articles 1, 2 and 3-2. Where the files are kept, for how long, and through whom did not change.
  On the same day, Google began drawing the Google button on the web sign-in page itself, and that was added to "Storage inside your browser" in Article 1. Opening the sign-in page loads Google's script, and if the browser is signed in to Google the button shows that account's name and picture. The sign-in method and what Google receives (Article 3-2) are unchanged.
• 26 September 2026 — Web usage counts were added (can be turned off in Settings).
  The web has used no analytics tool so far, and that promise stands — no analytics or advertising scripts, and no cookies. What was added is four daily counts of how often features are used (Article 1), with no account, IP address, value that could single out a device or browser, or note content. They are stored in the same Cloudflare database as shared links (Article 3-2) and destroyed after 25 months (Article 4). Nothing is sent if you turn it off in Settings or your browser sends Global Privacy Control.
• 19 September 2026. The trash became one place shared by the app and the web.
  Until now Article 4 of this policy said “what you delete on the web stays in the trash for 14 days”, and a deletion in the app removed the note from the server at once. From version 1.7 of the app (iOS), a deletion in the app also leaves a 14-day copy in the same trash under the same account, and it can be restored from either side. The period (14 days) and the once-a-day clean-up job on the Company's servers are unchanged, and neither the storage location nor any cross-border transfer has changed (the Cloud Firestore of Article 1, Seoul region).
  This is a change in your favour — a note deleted on the phone by mistake can now be restored — at the cost that a copy which used to disappear at once is now kept on the server for 14 days. An item was added to Article 4 to state that. While you are on app 1.6 or earlier, deleting in the app leaves no copy.
• 18 September 2026. The retention period for the web trash was shortened from 30 days to 14, the job that actually deletes expired copies now runs on the Company's servers, and a read-only share link now carries the note's attachments.
  One, the period is now 14 days instead of 30. That sentence in Article 4 was changed. It is not a change in your favour — the window in which something can be restored is shorter — and it is recorded as such. In exchange, the two points below became true.
  Two, “it is deleted automatically after that” is now true. That sentence has been in this policy since 15 September, but the clean-up it described ran only when you opened the trash screen on the web. On an account that never opened it, the copy was still there after 30 days, so this policy did not match the facts. A job on the Company's servers now runs once a day (03:30 Korean time) and deletes expired copies. Because it runs once a day, a copy may remain for up to one more day past the period; that is written down too — saying “immediately” would make the sentence untrue again.
  Three, attachments that only the copy referred to are deleted with it. Previously only the record was removed and the photo, recording or document file stayed in storage. Something you were told was deleted remaining on the server is wrong regardless of whom it favours, so it is now deleted as well. Files referred to by a live note, or by another copy whose period has not run out, are not deleted — restoring something must not leave a gap.
  On the same day, Article 4 was updated to say that the trash now lives at Menu → Trash rather than Settings → Data. Pointing at the wrong place is also a wrong sentence.
  Four, a read-only share link now carries the note's attachments.
  Until then Article 1 said “Attachments are not included.” That sentence stopped being true, so it was corrected. Sharing a note with a photo in it used to send only the text, leaving an unreadable line where the photo had been — and neither the sender nor the reader could tell what was missing, which is why this was changed.
  The files themselves were not moved. Photos, recordings and documents stay in the storage named in Article 1; what Cloudflare's database holds is the address that points at each file, plus its name, type and size. When a reader opens a file, Cloudflare fetches it from that address and delivers it. So no new place of storage was added; Cloudflare was added to the delivery path, and Article 3 now says so.
  The promise about revoking is unchanged. Those addresses live on the same row as the shared copy, so revoking a link closes the text and the attachments in the same moment. Showing readers the underlying address would have been easier, but then anyone who saw it once would hold an address that cannot be revoked, so that path was not taken.
  Limits were set: 25MB per file, 100MB and 20 files per link. Anything over that is left out, and the screen tells you how many were left out when the link is created. Dropping things silently is the worst outcome.
  This revision also failed the seven-day notice. All four points above ship in one release and take effect on the day it ships, for the same reason as on 15 September: leaving an untrue sentence in place for a week is worse than correcting it at once and recording that here.