Privacy Policy

Last updated: 7 August 2026

The short version: Cyanote is local-first. Your notes, tasks, habits, and everything you create stay on your own device. We don't run a server that stores your content, we don't have accounts, and there is no analytics or telemetry in the app. The app makes two network requests of its own: a one-time licence activation when it is first installed (section 2), and a check for new versions (section 3), which carries no key, account or identifier. There is a third that happens only if you ask for it — subscribing to a calendar makes the app fetch the address you gave it (section 4). None of the three carries a word you have written. Those sections explain exactly what each one sends, including what we can infer from it.

1. What the app collects

Nothing on our servers. All your data — notes, to-dos, calendar, habits, clipboard history, settings — is stored locally on your own computer, in a SQLite database at ~/Library/Application Support/app.cyanote.desktop/ on a Mac (or a different folder, if you chose one in Settings). It is never uploaded to us and we have no way to read it.

There is no account, and no analytics or telemetry of any kind: no analytics SDK, no crash reporter, no usage pings, no device or install identifier generated by the app. The app is also locked down at the browser level — its content security policy permits no outbound network connections at all from the app's interface. Everything that reaches the internet is made by the app itself rather than by its interface: the one-time licence activation in section 2, the update check in section 3, and — only if you subscribe to a calendar — the fetch of the address you supplied, in section 4. Together they are the complete list of what leaves your machine.

2. Licence activation — once, on a new install

A new installation asks for the licence key from your purchase email before it opens. The app sends that key, once, to Lemon Squeezy at api.lemonsqueezy.com to confirm the purchase, and stores the result on your computer. That request carries the key you typed and a label naming the Cyanote version and operating system — "Cyanote 1.0.6 (macos)". It does not carry your name, your computer's name, or any of your notes.

After it succeeds, nothing runs again. There is no re-check on launch, no periodic validation and no expiry sweep — the app never contacts Lemon Squeezy a second time. Only a genuinely new install is ever asked: if the app finds traces of a previous launch on the machine — a notes database, a backups folder, saved window state — it never asks for a key, and the request is never made at all.

Lemon Squeezy processes that request under their privacy policy, and it tells them your IP address and that a copy was activated. We see it in our seller dashboard as an activation against your order. See section 5 for what they hold about the purchase itself.

3. Software updates — what we can see

Updates are included in the price and cost nothing extra. The update check is anonymous: it carries no key, no account and no identifier, and it is a different request to a different server from the activation above. Nothing about your purchase is attached to it, and nothing stands in its place. It still has privacy consequences, and we'd rather state them plainly than bury them.

Cyanote checks https://updates.cyanote.app/latest.json. That is our own server (a Cloudflare Worker in front of a private storage bucket), not GitHub. Each check sends:

It sends none of your notes or other content. But we want to be direct about the rest: an IP address is still personal data, and the request still says a copy of Cyanote is running. Checks run about 4 seconds after the app launches and then every 6 hours for as long as it stays open, so the server's access logs can be used to derive how often and roughly when Cyanote is launched from a given IP address. When you actually install an update, the download request also shows which version was fetched. Request logging is enabled on that service, so those records exist. What we cannot do is connect any of it to your order — there is nothing in the request to connect it with. We don't build profiles from these logs and we have no interest in doing so.

If you never want the app to talk to our server, block updates.cyanote.app or take the machine offline. Once the app is installed and activated, this is the only request it makes on its own unless you subscribe to a calendar, and it works fully without it — you would simply stop being told about new versions.

4. Calendar subscriptions — only if you add one

Subscribing to a calendar is the one network feature you switch on yourself. If you add a subscription in Settings, the app fetches the address you gave it so those events can appear alongside your tasks. That request goes to whoever runs that calendar — Google, if it is a Google Calendar — and not to us: we never see it and it is not routed through anything of ours. It carries the address itself and nothing else: no key, no account, no identifier, and none of your notes. It is a read, so nothing you write in Cyanote is ever sent to the calendar.

Nothing happens here until you add one. After that the app refreshes each subscription at most every 30 minutes while it is open, and whenever you press Refresh. Remove the subscription and the requests stop. Importing an .ics file instead makes a local copy and no request at all.

The app will only fetch https:// addresses that resolve to public servers, and it re-checks that after every redirect — so an address that is mistyped or hostile cannot be used to reach your router, your local network, or anything running on your own machine.

5. Purchases

Payments are processed by Lemon Squeezy, our reseller (Merchant of Record). When you buy Cyanote, Lemon Squeezy collects the information needed to complete the sale (e.g. name, email, billing details, and tax location) under their own privacy policy. We receive only limited order information (such as your email and that a purchase was made) to provide support and deliver your download. We never see your full card details.

6. This website

Our website is served by a static hosting provider, which may keep standard server logs (such as IP address and browser type) for security and reliability. We also use privacy-friendly, cookieless analytics to count visits and see which pages are read — it sets no cookies, stores no personal data, and cannot follow you to other sites. We don't add advertising trackers.

7. Support email

If you email us, we'll use your message and address only to help you and to keep a record of the conversation.

8. Your rights

Because we hold almost no personal data, there is little to request — but you can contact us any time to ask what we have, or to have your support correspondence deleted. For purchase data, you can also contact Lemon Squeezy directly.

9. Children

Cyanote is not directed at children under 13, and we don't knowingly collect their data.

10. Changes

We'll update this page if our practices change and revise the date above.

Questions? Email support@cyanote.app.