S
Supanote
Sign in Sign up
LEGAL · LAST UPDATED: SEPTEMBER 2026

Privacy Policy

Our core promise is simple: Paste anything, get a clean link. We collect only what is strictly necessary to run this service, sell nothing, and respect your privacy.

1. Core Privacy Philosophy

Supanote is designed from the ground up for minimal friction and maximum privacy. You do not need an account to create or share a note. We do not track you across the web, we do not use third-party analytics trackers or advertising networks, and we never sell, rent, or monetize your personal data.

If you choose a paid Pro subscription, payment processing is handled by our billing partner Polar.sh. That relationship is limited to checkout, tax compliance, invoicing, and subscription management — not advertising or data brokerage.

2. Information We Collect

  • Paste Content: The text, source code, Markdown, JSON, SVG, HTML, or log data you paste into the editor is stored to generate your shareable link.
  • Technical Data & Logs: Temporary server access logs (including your IP address, user-agent string, and request timestamps) are processed strictly for DDoS protection, rate limiting, and security monitoring. These logs are cycled and discarded regularly.
  • Cookies & Local Storage: When you create a note, a unique manage token is stored in your browser cookies and local storage (sn_token_*) so you can edit or delete your paste without needing an account. We also store your light/dark theme preference locally.
  • Optional Account Data: If you choose to register an account, we store your email address and an irreversibly hashed password (using bcrypt with cost factor 12).
  • Billing & Subscription Data: If you subscribe to Supanote Pro, we store your plan tier, Polar customer and subscription identifiers, subscription status, current billing period end date, and whether cancellation is scheduled. We do not store full payment card numbers, CVV codes, or bank account details on Supanote servers.

3. Payment Processing (Polar.sh)

Paid subscriptions are processed by Polar.sh, which acts as merchant of record. When you checkout or manage billing, Polar may collect and process:

  • Your email address and billing contact details
  • Payment method information (handled directly by Polar and its payment providers)
  • Billing address and tax identifiers where required by law
  • Transaction, invoice, and subscription lifecycle records

Supanote receives webhook notifications from Polar to activate, update, or downgrade your account tier after successful payment events. Checkout metadata may include your Supanote user ID and public profile identifier to link the subscription to your account.

Polar's handling of payment data is governed by Polar's Privacy Policy. Billing terms are described in our Terms of Service.

4. Content Visibility & Expiration

You control who can discover and access your pastes:

  • Unlisted (Default): Notes are not listed on any public index and include strict <meta name="robots" content="noindex,nofollow"> headers preventing search engine crawlers from indexing them. Only people with your unique link can view the content.
  • Public: Notes may be indexed or listed in public directories.
  • Private: Restricted to authenticated users with owner permissions.
  • Automatic Expiration: Notes configured with an expiration duration (1 hour, 1 day, 7 days, 30 days) become inaccessible immediately upon expiration and are periodically deleted.

5. Security & Protection

We implement rigorous defense-in-depth security measures to protect your shared data:

  • Hashed Manage Tokens: Secret note management tokens are never stored in plaintext in the database. Only their SHA-256 HMAC hash is stored, making it mathematically impossible to recover tokens from database backups.
  • HTML & SVG Sandboxing: User-submitted HTML and SVG previews are strictly rendered inside isolated, sandboxed <iframe sandbox=""> elements prohibiting script execution and cross-origin access.
  • Nosniff Raw Endpoints: Raw note content is served with strict X-Content-Type-Options: nosniff headers to prevent MIME-type sniffing attacks.

6. Data Deletion & Your Rights

You have the absolute right to delete any note you create at any time using your manage token or from your account dashboard. Once deleted, the note is immediately removed from public view. If you wish to delete your entire registered account, you can do so by contacting us.

7. Contact Us

If you have questions, privacy concerns, or requests regarding this Privacy Policy, please reach out to us at: privacy@supanote.app.

Notification