Last updated 24 September 2026
Privacy policy
Levitating Notebook is a private notebook. Your notes are end-to-end encrypted: they are locked in your browser before they reach us, and we cannot read them.
Who is responsible
Levitating Notebook is run by the operator of this site, who is the data controller for the personal data described here. Questions and requests: [contact email not yet configured].
End-to-end encryption
Notebook titles, page titles and page content are encrypted in your browser with a key made from your password. Your password itself is never sent to us; we receive only a separate value derived from it, which we store in hashed form to check that it's you. We hold your notes only as encrypted data we have no way to open.
This also means we cannot recover your notes for you. If you forget your password and lose your recovery key, your notes are gone for good.
What we store
- Your account: your username, your email address if you choose to add one, the hashed login value described above, your encryption key in locked form (it can only be unlocked with your password or recovery key), your theme choice and when the account was created.
- Your notebooks: the encrypted titles and content, and information we need to run the service that is not encrypted: when each notebook and page was created and last changed, how many you have, their approximate size and which cover design each notebook uses.
- Sign-in sessions: a record for each device you're signed in on, kept for up to 30 days or until you sign out.
- Password reset links: if you ask for one, a record of it for one hour.
- Abuse protection: to stop password guessing and spam, we count recent attempts per IP address and per account. These counters are stored as one-way hashes, not as readable IP addresses or usernames, and are deleted once their time window (at most one hour) has passed.
What we don't do
No advertising, no analytics or tracking scripts, no tracking cookies, and we never sell or share your data for marketing. Fonts are served from our own site, so loading a page doesn't contact third parties.
Cookies and browser storage
We set one cookie, ln_session, which keeps you signed in. It is strictly necessary for the service, so it doesn't need consent. Your browser also keeps your encryption key on your device (in a form that can't be copied out by web pages) so you don't have to unlock your notes on every visit; it is removed when you sign out.
Service providers
We use a few companies to run the service. They process data only on our instructions:
- Vercel hosts the site. Like any web host, it processes your IP address and technical request data, and keeps short-lived logs.
- Neon hosts the database where your account and encrypted notes are stored.
- Resend sends password reset emails, only if you added an email address and ask for a reset.
These providers may process data outside your country, including in the United States. Where the law requires it, transfers are covered by the providers' data processing agreements and the European Commission's Standard Contractual Clauses.
Why we process your data
To provide the notebook you signed up for (performance of a contract), and to keep it secure and working, including preventing abuse (our legitimate interest in running a safe service). We only use your email address to send password reset links.
How long we keep it
For as long as you have an account. When you delete your account in Settings, your account and every notebook and page are deleted from our database immediately. Copies can remain in our database provider's backups for up to 30 days before they are overwritten. Each account can store up to 5 MB.
Your rights
Depending on where you live, you have the right to:
- get a copy of your data: use Download my data in Settings;
- correct it: change your email address in Settings;
- delete it: use Delete account in Settings;
- object to or restrict processing, and to complain to your data protection authority.
For anything else, contact [contact email not yet configured]. We'll reply within one month.
Security
Besides end-to-end encryption, passwords are never stored or sent, connections are encrypted, sign-in attempts are rate-limited, and the site uses a strict content security policy. No system is perfectly secure; if we learn of a breach affecting your personal data, we will tell you and the relevant authorities as the law requires.
Age
You must be at least 16 years old to use Levitating Notebook.
Changes
If we change this policy, we'll update the date above, and tell you in the app before significant changes take effect. See also our terms of service.