Privacy Policy

Effective date: October 10, 2026

Zabulan LLC ("we", "us", "our") operates the zabnotes.com website and application. This Privacy Policy explains what information we collect, how we use it, and the choices you have.

1. Information We Collect

Account Information

When you register, we collect your username, your email address and a hashed password. We never store your password in plain text. We also record when you confirmed your email address, and the date and version of the Terms and Privacy Policy you accepted. You may optionally upload a profile avatar. If an email address is never confirmed, it is deleted with its account 7 days after sign-up.

Notes & Content

We store the content you create — notes, kanban boards, mind maps, drawings, charts, plans and calendar events. All of it is encrypted on your device before it reaches us, including titles. What we hold is ciphertext. A few details, such as when a calendar event happens, are not; Account Encryption below lists exactly what is and is not covered.

Account Encryption

Every workspace in Zab Notes is end-to-end encrypted. This is not an optional vault you switch on for selected notes — it covers notes, kanban boards, mind maps, drawings, charts, the project planner and calendar events, titles included.

• Content is encrypted in your browser with XChaCha20-Poly1305 (IETF) before it is sent to us.
• Your password is never transmitted. It is put through Argon2id key derivation on your device, and only a derived value is sent, which we then hash again with bcrypt. We never see the password you type.
• A random account key encrypts your content. We store it only in wrapped form — once under a key derived from your password, once under your recovery key.
• At sign-up you are shown a 24-word recovery key, once. It is the only way back in if you forget your password.
• We cannot read, decrypt, or recover your content, and there is no password reset that restores it. If you lose both your password and your recovery words, your library is permanently unreadable — by you, by us, or by anyone who compels us.

What encryption does not cover: your email address, account and billing records, when you sign in, how much you store and when it changed, and your folder and tag structure. Some details are also stored readable, because our server sorts, filters or counts by them:

• Calendar events: when each one starts and ends, whether it is all day, how it repeats, its reminder and its colour, and, for an event imported from an .ics file, the identifier that file gave it. An event's title and description are encrypted.
• Projects: status, priority, health, colour, start and due dates, progress, budget and amount spent, and the due dates, done marks, impact and likelihood scores of milestones, tasks and risks. Every name, title, description, role and log entry is encrypted.
• Everywhere else: colours, order and position, flags such as favourite, whether a note is empty or contains an image, a fingerprint of each note's text (it lets us recognise identical versions without reading them), and dates such as when something was created, changed or moved.

The words you write are encrypted in every case. Files you upload — images and audio — are stored as uploaded and are not covered by the content encryption above. The older per-note vault remains available as an optional second lock on individual notes.

Share Links

When you share a note, your device encrypts a copy of it with a new key made for that link, and only that encrypted copy reaches us. The key is part of the link itself, after the #, a part of a web address that browsers never send to a server, so we can’t read shared notes either. A person who opens the link decrypts the note in their own browser. We can see which of your notes are shared and when each shared copy last changed. The copy is replaced each time you edit the note, and deleted when you stop sharing or delete the note; a note in the Trash is not shown to anyone. Anyone who has the whole link can read the note, so share it as carefully as the note itself.

Subscribed Calendars

You can show another calendar inside your Zab Notes calendar, read-only, by adding its link (Calendar → Calendar links), for example the calendar feed Zabulan provides. The link, the name you give it and its colour are encrypted on your device before they reach us, like the rest of your content. Your device reads the link directly from that calendar's own server: your browser, or the Zab Notes desktop app if you use it. Our server never fetches it and never sees the subscribed events. Nothing from a subscribed calendar is copied into your own calendar. So that it works offline, your device keeps the last copy it read, encrypted with your account key; that copy is deleted when you sign out. When your device reads the link, the calendar's server sees your IP address and browser or app details, as any website does, and its own privacy terms apply. No cookies or other Zab Notes data are sent with that request.

Payments

If you choose a paid plan, payment is handled by Stripe. Your card number, expiry date and security code go directly to Stripe and never reach our servers, and we do not keep your card brand or its last digits either. What we keep is Stripe's reference for you as a customer and for your subscription, which plan you have (monthly or perpetual license, and the license's version), its status, and the relevant dates (trial end, renewal, purchase). Stripe keeps its own payment records, including invoices and receipts, as the law requires.

Two-Step Sign-In

If you turn on two-step sign-in, we store the secret your authenticator app uses to make codes. Our server has to check those codes, so this secret cannot be end-to-end encrypted like your content: it is stored encrypted with a key held on our server. We also store when the last code was used (so each code works once) and keyed hashes of your recovery codes, never the codes themselves. We never see your phone or the app.

Activity Data

We log user actions (e.g., creating, editing, or deleting items) to power the dashboard activity heatmap and recent activity feed. Duplicate actions within 5 minutes are throttled.

File Uploads

Uploaded files (images, audio recordings, avatars) are stored in user-specific directories and are accessible only to the authenticated user who uploaded them. Unlike your notes, uploaded files are stored as uploaded and are not end-to-end encrypted.

Version History

We keep previous versions of your notes so you can restore earlier drafts, up to 150 versions per note, after which the oldest are pruned. Versions are encrypted exactly as the note itself is.

Diagnostic Records

When you submit a support ticket, we record the IP address and browser user-agent with it. If the application hits an error, our error log may record the error, the page URL, your email address, your IP address and your user-agent so we can diagnose it. We do not record IP addresses or user-agents at account creation.

2. How We Use Your Information

• Provide the service — store, sync, and display your notes and content across your devices
• Authentication — verify your identity when you log in
• Account emails — the link that confirms your address, one reminder if you have not confirmed it, a welcome message, one-time security codes, a link to confirm a new email address (with a notice to the old one), notices when two-step sign-in is turned on or off, and a notice when your account is deleted. On a paid plan, Stripe emails your receipts and invoices and, on the monthly plan, a reminder before your free trial ends. We do not send marketing email. Our team is told when a new account is confirmed (username and email address only)
• Two-step sign-in — check the code from your authenticator app when you sign in, if you have turned it on; and email a one-time code when you unlock a vault-locked note
• Activity features — power the dashboard heatmap, recent activity, and calendar views
• Theme & settings — remember your preferences across sessions

3. Cookies & Sessions

We use a session cookie to keep you logged in. This cookie contains only a session identifier — no personal data. A signed-in session lasts up to 30 days; the session of a visitor who never signs in is discarded after 3 days without a visit. We also store UI preferences (panel widths, folder collapse states) in your browser's localStorage. We do not use third-party tracking cookies or analytics services.

4. Third-Party Services

• Hostinger — hosting, database and outbound email for this service, and DNS for our domains.
• Cloudflare — R2 object storage only: media you upload, and off-site copies of our nightly database backups, which are encrypted before they leave our server. Cloudflare does not provide our DNS and no traffic is proxied through it.
• Stripe — payment processing for paid plans: checkout, subscriptions, invoices and refunds. Card details go directly to Stripe and never reach our servers.
• Calendars you subscribe to — if you add a calendar link, your browser (or the desktop app) contacts that calendar's server directly (for example zabulan.com) when you open the Calendar or press Refresh. That request does not pass through us.
• GitHub — source code hosting and automated deployment.
• Google Fonts — We load fonts from fonts.googleapis.com. Google may log font requests per their Privacy Policy.
• CDN Libraries — JavaScript libraries loaded from cdn.jsdelivr.net, cdnjs.cloudflare.com and cdn.quilljs.com. These providers receive your IP address and browser details when your browser fetches those files, as any third-party resource does. They are not used to track you.

5. Data Security

• All connections use HTTPS
• Passwords are hashed using bcrypt (12 salt rounds)
• CSRF protection on all API endpoints
• Rate limiting on login, registration and account emails
• An account cannot be used until its email address is confirmed
• Optional two-step sign-in with an authenticator app (time-based one-time codes), with single-use recovery codes
• Content Security Policy (CSP) headers
• All content encrypted on your device with XChaCha20-Poly1305 (IETF), keys derived with Argon2id
• Nightly database backups encrypted with AES-256-GCM before they are written, and verified by decrypting them
• Server access by SSH key only; password authentication is disabled

6. Administrative Access

Designated administrators may view limited account metadata for the purpose of customer support, billing, security, and abuse prevention. Specifically, administrators may see:

• Your username, email address, and account creation date
• Your plan (monthly or perpetual license, and its version), its status, and its trial, renewal and purchase dates — never your card details, which only Stripe holds
• Your last-active timestamp and a derived "online" indicator (active in the last 5 minutes)
• Aggregate counts of items you've created (number of notes, mind maps, drawings, etc.) — never the items themselves
• Total storage used by your notes (size in bytes of the stored ciphertext), without access to the contents
• Aggregate activity statistics, including how often and at what hours you use the app
• The IP address and user-agent recorded when you submit a support ticket, and those recorded in our error log if the application faults while you are using it

Administrators cannot view note titles, note contents, search terms, or specific items you are working on. This is not a policy promise — it is a property of the system: your content is encrypted on your device and we hold no key that can decrypt it, so even an administrator with full database access sees only ciphertext. Uploaded files are the exception: they are not end-to-end encrypted, and an administrator with server access could open them.

All administrative access actions are recorded in an internal audit log with timestamp, the administrator's identity, and the nature of the access. If you wish to know what administrative access has occurred against your account, contact contact@zabulan.com.

7. Data Retention

Your data is retained as long as your account is active, with these exceptions:

• Trash — a note you delete goes to Trash, where you can restore it for 30 days. After that it is deleted permanently, with its version history. (This rule began on October 4, 2026; notes already in Trash then were kept until November 3, 2026.) Permanently deleting a note yourself removes it at once.
• Activity records and error-log entries are deleted after 12 months.
• Short-lived records — used one-time codes, expired links, unfinished two-step sign-in set-ups and the sessions of visitors who never signed in are deleted within a few days.
• When a plan ends — if a trial ends without a plan, a subscription ends or a license is refunded, your content is kept for at least 90 days so you can export it or choose a plan.
• Payment records — when you delete your account, our record of your plan is deleted with it and any running subscription is cancelled first. Stripe keeps the payment records (invoices, receipts) for as long as tax and accounting law requires.

Account deletion is self-service: open Account & Security from the avatar menu in the app. Deletion is immediate. It removes your account record, all of your content and its version history, your uploaded files (including images held in Cloudflare R2) and any error-log entries that name you from our active systems. Two things remain: support messages you sent us are kept as business correspondence, no longer linked to an account; and our internal audit log keeps a line recording that an account number was deleted and when, without your email address. Deleted data then ages out of our encrypted backups within approximately six months, on a 7-daily / 4-weekly / 6-monthly retention cycle. You can also ask us by email and we will do it for you.

Unconfirmed accounts — an account whose email address is not confirmed within 7 days of sign-up is deleted automatically, in the same way.

8. Your Rights

• Access & Export — Export any note as HTML, Markdown or PDF. File → Offline Folder… mirrors your whole library to a folder on your own computer — every note as .html and .md, every board, map, drawing and chart as .json, plus a complete _library.json, all written in readable form
• Correction — Edit your content and profile at any time. Change the email address on your account yourself in Account & Security: we send a link to the new address, and the change takes effect when you open it
• Deletion — Delete individual notes, or your whole account yourself in Account & Security (section 7)

9. Children's Privacy

Zab Notes is not directed at children under 13, and we do not knowingly collect information from children under 13. You must be at least 13 to create an account. If you are between 13 and 18, you may use Zab Notes only with the involvement and consent of a parent or guardian. If you believe a child under 13 has provided us personal information, contact contact@zabulan.com and we will delete it.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Changes are posted on this page with a new effective date, and we ask you to review and accept the new version before you continue using the app.

11. Contact

Questions about this Privacy Policy:
contact@zabulan.com