MevaNote Privacy Policy

1. Data controller

The controller of personal data in MevaNote (note.mevasearch.com, "the Service") is Igor Oprządek, Bągart 14A, Poland, e-mail: privacy[at]weborbiton.com.

The Service is part of the MevaSearch ecosystem and follows the same privacy principles. This policy covers MevaNote only. The MevaSearch search engine is covered by the separate MevaSearch Privacy Policy.

2. Data Protection Officer

No Data Protection Officer has been appointed.

3. Nature of the Service

MevaNote is a free online notepad that runs in your browser. It needs no account or registration.

• no user accounts and no cookies,
• no profiling and no cross-site tracking,
• no tracking identifiers,
• no ad-network ads and no sale of data to third parties.

4. Data stored in your browser

Note content (titles, text, inserted images) and settings are stored only in your browser’s local storage (localStorage), under these keys:

• mevanote_v1_notes – your notes and, for shared notes, the link identifier and secret edit key,
• mevanote_v1_current – the last opened note,
• mevanote_settings – settings: theme, text size, spell check, handling of images from links, trusted sites, chosen language and language suggestion,
• mevanote_theme – theme saved by an older version of the Service.

This data is not sent to or read by our servers (except for sharing, section 5). Clearing your browser data deletes it permanently, so you can export a backup in Settings. You can also delete all local data at any time with the button in Settings.

5. Sharing notes

Only when you click Share → Generate link are the title and content of the note (including embedded images) sent to our server and stored under a random identifier. Anyone who knows the link can read that copy. Do not share passwords or sensitive personal data.

• When a link is created, your browser receives a secret edit key. The server stores only a one-way hash of it, so only the browser that created the shared version can update or delete it.
• You can delete the shared version at any time with Stop sharing.
• Shared notes are deleted automatically 90 days after their last update.
• To prevent abuse, we keep a salted one-way hash (HMAC) of your IP address with the request time for up to 1 hour. The IP address itself is not stored with the note.
• Shared-note pages contain no analytics, are not indexed by search engines and send no referrer when links are clicked.

6. Images

Images from your device are resized and re-encoded directly in your browser. This removes hidden file metadata (such as EXIF, GPS location or device model) before the image is added to the note.

Images from links stay on another website’s server. The Service does not load them automatically: it first asks whether you want to connect to that domain (unless you choose "Always load" in Settings or add the domain to trusted sites). Once you agree, your browser loads the image directly from that server, which then sees your IP address and browser data and applies its own privacy policy. We do not send it a referrer. People reading a shared note are asked for consent as well.

7. Language detection

The Service never redirects you automatically based on language or location. The language is determined only by the address (for example /pl). If your browser’s language differs from the page language, your browser may suggest switching – locally, without sending anything. Your choice is saved only in local storage. You can turn this off in Settings.

8. Analytics: PriviMetrics

We use our own analytics system, PriviMetrics (analytics.mevasearch.com), running on our own servers:

• no cookies and no user tracking,
• IP address processing for analytics is disabled,
• aggregate data only: number of visits, country, browser type.

Analytics is not loaded on shared-note pages and has no access to note content.

9. Purposes and legal bases (GDPR)

• sharing notes at your request: Art. 6(1)(b) GDPR,
• security, operation of the Service and abuse prevention (rate limits, logs): Art. 6(1)(f) GDPR,
• privacy-respecting traffic analysis: Art. 6(1)(f) GDPR.

10. Server logs

The server keeps technical logs containing the IP address, date and time of the request and browser type, solely for technical, security and diagnostic purposes.

11. Recipients

Hostinger – hosting provider. Service files and shared notes are stored on servers in Lithuania (primary) with backups in France, within the European Economic Area. Static files (scripts, styles, fonts) may be delivered through a global CDN, which processes no personal data or note content.

The Service loads no third-party fonts, scripts or ads. We do not sell or share data for advertising, profiling or commercial purposes.

12. Retention

• shared notes: until you stop sharing, at most 90 days after the last update,
• IP hashes for rate limiting: up to 1 hour,
• technical logs: up to 30 days,
• analytics data: up to 12 months,
• local data: until you delete it.

13. Your rights

• access, rectification and erasure of data,
• restriction of processing and data portability,
• objection to processing based on legitimate interest,
• complaint to the Polish supervisory authority (PUODO) or your local data protection authority.

Shared notes are not linked to any person – they are identified only by their link. When writing about a specific note to privacy[at]weborbiton.com, please include its link.

14. Voluntary use

Using the Service and sharing notes is voluntary. The Service does not require any personal data.

15. Profiling and automated decisions

The Service does not use profiling or automated decision-making (Art. 22 GDPR).

16. Transfers outside the EEA

Shared notes and logs are stored in the EEA. Outside the EEA, only static technical files may be cached on CDN nodes, without personal data. Images from links that you choose to load come from servers chosen by the note’s author, which may be located anywhere in the world.

17. Changes to this policy

We may update this policy. The current version and date of change are always shown at the top of this page. Questions? Write to privacy[at]weborbiton.com.