Privacy

Your account. An email address and a password, which is stored hashed and is never readable by anyone running the service. Optionally a full name, an admission year, a current semester and an avatar image, all of which you supply and can edit or clear at any time.

What you upload. The files you upload, the details filed with them (paper, semester, date, tags, an optional link), your comments, and your private saved list. Uploaded material is visible to other signed-in members once a moderator verifies it; your saved list is visible only to you.

An activity record. Actions taken through the service — signing in, uploading, viewing and downloading material, moderation decisions — are recorded with the time, your account, and the IP address, browser, operating system and device type the request came from. This exists so a shared library can be moderated and abuse traced. It is readable by super admins; you can see your own recent activity on your account page.

Reports you file. A bug report additionally collects a short technical snapshot — browser version, screen size and the page you were on — because that is usually what makes a bug reproducible. You choose whether to attach a screenshot.

Notifications. If you turn on push notifications, your browser’s push endpoint and its encryption keys are stored so a message can be sent to it. Turning notifications off removes it.

Your sign-in token is kept in your browser’s local storage so you are not asked to sign in on every page. It is removed when you sign out.

If the app is installed or has been visited before, a service worker keeps a copy of pages and of the note files you have opened so they can be read without a connection. That copy lives only on your device. Because NoteVault is often used on a shared phone or laptop, signing out deletes the private part of it immediately.

NoteVault shows ads from Google AdSense to cover the cost of running the server and storing the files.

Google, as a third-party vendor, uses cookies to serve ads on this site. Google’s use of advertising cookies enables it and its partners to serve ads to you based on your visit to this site and other sites on the internet. You can opt out of personalised advertising by visiting Google Ads Settings, or opt out of a third-party vendor’s use of cookies for personalised advertising at aboutads.info.

Advertisers receive no account information from NoteVault. No ad is shown on the sign-in, sign-up or password pages, or on the offline page, and none is shown at all while your device has no connection. If you open NoteVault straight onto one of those pages, Google’s script is not loaded either.

If you are in the EEA, the UK or Switzerland. Advertising and analytics storage start out denied for visitors from those countries, so nothing is stored on your device and ads are non-personalised unless you say otherwise in the consent prompt Google shows. Elsewhere the ordinary settings above apply, and the opt-out links work everywhere.

NoteVault uses Google Analytics to count visits and see which pages get used. It records the address of the page you are on, roughly where in the world the request came from, and what kind of browser and device it is.

It is not told who you are. Your account id, your email and the titles of anything you open are never sent to it — a page address such as /notes/{id} is as specific as it gets, and only someone already signed in can turn that into a note. Google Analytics sets its own cookies to tell one visit from another; you can opt out across every site that uses it with Google’s opt-out browser add-on.

Amazon Web Services. Uploaded files, avatars and screenshots are stored in Amazon S3, and the service runs on an AWS server. Files are served through short-lived links that expire after about an hour.

Google. For advertising and analytics, as described above. Some material is a live Google document rather than an uploaded file; opening such a note loads it from Google, and Google’s own terms apply to it. A note marked private in NoteVault is private in NoteVault — the document behind it is governed by whatever sharing you set in Google.

Your browser’s push service. If you enable notifications, messages are delivered through the push service your browser uses.

Nothing is sold, and nothing is shared with anyone else except where the law requires it.

You can delete your account yourself from your account page. Doing so removes your profile and signs you out permanently; material you uploaded may remain in the library, shown as coming from a deleted user, because other people’s saved lists and comment threads refer to it. If you want something you uploaded removed as well, ask before deleting the account — afterwards there is no way to prove it was yours.

Records in the activity trail are kept for moderation and are not deleted with the account, but the account they point at no longer exists.

NoteVault is intended for students at university level and is not directed at children under 13.

If what is collected changes, this page is updated and the date at the top changes with it. Material changes are also noted on the release notes page.

Questions about anything here, or a request to have something removed: use the report form if you have an account — it works even while your account is waiting to be approved — or open an issue at github.com/visshal14.