Privacy policy
What the app keeps about you, where, for how long, and what you can do about it. It is the same text you can read inside the app.
Last updated October 7, 2026
What we keep
Without an account, nothing leaves your phone except a crash report, if you leave those on. With an account, we keep your email address, your password in hashed form, and the notes and todos you write: titles, text, tags, dates, risk history and the links between them. Something you share is kept as a second copy, encrypted, until you revoke it. The temporary note is never sent.
What a crash report says
When the app breaks it sends a report, so the fault can be found and fixed. These are the faults nobody reports by hand: the screen recovers and there is nothing left to describe. A report carries the fault and where in the code it happened, the phone model and its system version, the app version, and how the phone stood at that moment: memory, storage, battery, language and time zone. It also carries an installation number, a random value made when the app was installed, so that several crashes from one phone read as one fault rather than many. That number is not your account and says nothing about you. No note, todo, tag or temporary note is ever included, and no trail of what you were doing beforehand is kept. Turn off Send crash reports in Settings and nothing is sent at all.
What the calendar and contacts are read for
If you turn on the device calendar, the app reads the events in the calendars you pick, and if you turn on birthdays it reads the names and dates in your contacts. Both are read on the phone and stay on it: they fill the calendar and the widget, they are not part of what syncs, a share never carries them, and nothing from either is ever sent to us. An event you write or change from the app goes straight into the phone's own calendar, which is the only place it is kept. Turn either off in Calendar settings, and nothing is read at all.
Why
Only to keep your notes and todos in sync across your devices, and to hand on what you choose to share. No ads, no tracking, no analytics, and no profile of how you use the app. The one thing sent that is not yours is a crash report, so faults can be fixed; you can switch that off in Settings. Nothing is sold, and nothing is shared unless you share it yourself.
Where
On your phone, and with Supabase, the service that hosts our database. A shared copy sits there too, encrypted, and is read through whichever web address the app is set to share from. Crash reports go to Sentry, on its European servers, and are kept there only as long as it takes to fix what went wrong.
Who can see it
Only you, unless you choose to share something. Other users cannot read your data. As the operator we can technically reach the database, but we do not read your content unless you ask us to, for example for support, or the law requires it. Anything you share is the exception in your favour: it is encrypted on your phone before it is sent, so we cannot read it at all.
What sharing does
Sharing makes an encrypted copy of what you picked and puts it on the server. The key that opens it travels inside the link, in the part a browser never sends to anyone, so what we hold is text we cannot read. Whoever has the link can read it, including anyone it is passed on to, which is why a link can carry a password and can be revoked at any time.
How long
A note or todo you delete is emptied on the server straight away: all that is left is a marker saying it went, so your other devices remove it too, and the marker itself is deleted after 30 days. A shared link expires 30 days after it is made, sooner if you revoke it; revoking destroys the key that opens it, and the remaining unreadable copy is deleted within a week. Delete my account, in Settings, erases your account and everything in it.
Your rights
Under the GDPR you can access, correct, export or erase your data, and withdraw your agreement at any time by deleting your account. You can also complain to your data protection authority, the CNIL in France.
Contact
Write to contact@codewave-consulting.fr. This policy is also published at codewave-consulting.fr/knot/privacy.
Who publishes the app
Knot is published by CodeWave Consulting, which is responsible for your data. Company details are in the Legal notice