Privacy policy

Last updated 30 October 2026

This policy explains what Pondnote stores about you, why, and for how long. In short: your notes, your name and picture from your login, and what is needed to keep the service running and safe. No ads, no trackers, no selling of data.

Who is responsible

Your account

You sign in with Google or Discord. From them we receive an account id, your display name and your profile picture, and from Discord also your username. We don't receive your email address or contacts. We keep this for as long as you have an account (Art. 6 (1) (b) GDPR).

Your notes

Notes, notebooks, ponds, pictures and imported PDFs are stored on your device and on our server, so they are on every device you sign in on (Art. 6 (1) (b) GDPR). The server is hosted by Akamai (Linode) in Frankfurt, Germany. We don't read your notes; we only look at stored data when you ask us to, or to fix a fault that affects it.

Notes you share

When you share a note or a notebook with a view link, anyone who has the link can see it and your display name, without an account, live as you write (including your pointer and pen while you're on it), and copy notes into their own Pondnote, until you turn the link off. We count how often a link is opened, nothing about who opened it.

When you invite people to edit a note, everyone in it sees the others' display names, pointers and pens while they're there. What they write is stored with the note in its owner's account. Pointers and pens in progress go through our server and are never stored.

Keeping the service safe

We store the IP addresses an account was used from (for IPv6 only the first half, which names the network rather than the device) and the country and city they belong to, for up to 90 days, and count requests per address, to stop abuse such as mass account creation (Art. 6 (1) (f) GDPR). When the app crashes, it sends us the error message, the page and your browser's name, without your account or notes, so we can fix it (Art. 6 (1) (f) GDPR). We keep the 500 most recent ones.

Reports of shared notes

When you report a shared note, we keep what you say about it, the note's link, your IP address (to stop one address sending a flood of reports) and, only if you give it, your email address, to answer you. The note's owner sees none of this, only the reason we give if we turn their link off. Once the report is handled, your IP address and email are deleted after 90 days; what you said stays with the decision. The legal basis is our legal duty to handle reports (Art. 16 DSA, Art. 6 (1) (c) GDPR) and our interest in a safe service (Art. 6 (1) (f) GDPR).

Feedback

When you send feedback from the app, we keep what you write, the picture if you add one, your email address only if you give it, and with it your account, the app's version, your browser's name, the size of your screen and which screen of the app you were on (not which note). We read it in a private channel on our Discord server and in our admin panel, to answer you and improve Pondnote (Art. 6 (1) (f) GDPR). It is kept until you delete your account.

YouTube videos

When you add a YouTube video to a note, our server asks YouTube for its title and its preview picture, which are kept with your note like a picture you added; YouTube sees our server's address, not yours. Opening a note with a video sends nothing to YouTube. Only when you press play is YouTube's player loaded, from youtube-nocookie.com, by Google Ireland Limited under its own privacy policy: from then on YouTube receives your IP address and may store data in your browser. Pressing play is your choice (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG).

On your device

The app keeps your notes, your login and your settings (such as the theme) in your browser's storage. This is needed for the app to work, also offline (§ 25 (2) TDDDG). There are no cookies for tracking or advertising.

Payments

Pondnote Plus is sold by Paddle.com Market Ltd, our reseller and merchant of record. Paddle processes your payment details under its own privacy policy; we receive your plan, its status and the amounts paid, not your card details.

If you came through a creator's link, we keep which link it was and when you opened it, so the creator gets their share (Art. 6 (1) (f) GDPR); the creator sees only numbers, never who you are. If you are a creator, we keep the name and IBAN you give for payouts and pass them to Wise, the payment service that sends the money, for as long as the law requires us to keep payment records (Art. 6 (1) (b) and (c) GDPR).

Who else processes data for us

• Akamai Technologies (Linode): the server that holds accounts and notes.
• Cloudflare: delivers the website and app files, passes the app's requests on to our server with the country and city of the address they came from, and counts page views without cookies.
• Google and Discord: only when you sign in with them, under their own privacy policies. Feedback you send from the app is also posted in a private channel on our Discord server.
• Paddle: payments, see above.
• YouTube (Google): a video's title and preview picture when you add one, and its player when you press play, see above.

Where a provider processes data outside the EU, this is covered by the EU-US Data Privacy Framework or the EU standard contractual clauses.

Deleting your data

Settings, Delete account removes your account and all your notes from the server at once, and from the device you do it on. Copies in our backups are gone after 14 days. Signing out removes the notes from that device; they stay in your account.

Your rights

You may ask what we store about you, have it corrected or deleted, restrict or object to its use, and get your data in a portable form (Art. 15 to 21 GDPR). Write to support@pondnote.ink. You may also complain to a data protection authority, for example the one where you live.