Privacy Policy

Best Note (“we”, “us”, “our”) provides a browser extension for rich notes and web clipping (“Service”) at bestnote.app and related browser stores. This Privacy Policy explains how information is handled when you use Best Note.

1. Summary

• Free / local use: Notes are stored in your browser (IndexedDB). We do not receive your note contents.
• Pro sync: Note bodies are encrypted on your device before upload. Our servers store ciphertext, not readable notes.
• Account data: If you sign in, we process authentication data (for example email) via Firebase Authentication.
• Website: This marketing site is static and does not require an account.

2. Information we process

2.1 On your device (local)

The extension stores notes, tags, preferences, and related metadata locally in browser storage (including IndexedDB and extension storage). This data stays on your device unless you enable Pro sync or export it yourself.

2.2 Account & authentication (optional)

To use Pro features you may create or sign into an account. Authentication is provided by Firebase Authentication (Google LLC). Depending on the method you choose, this may include:

• Email address and authentication credentials
• Google account identifiers if you use Google sign-in
• Session tokens required to keep you signed in

2.3 Encrypted sync data (Pro)

When Pro sync is enabled, the extension encrypts note content in the browser using AES-256-GCM before transmission to api.bestnote.app. We store:

• Encrypted note payloads (ciphertext) and initialization vectors
• Encrypted key wraps needed for unlock on your devices
• Sync metadata such as timestamps, sequence numbers, tombstones, and conflict fields
• Account tier / subscription status needed to authorize Pro features

We do not have access to your encryption password, recovery words, or plaintext note bodies.

2.4 Website & support

If you email support@bestnote.app, we process the content of your message and email address to respond. Hosting providers (for example Cloudflare) may process standard technical logs (IP address, user agent, request metadata) for security and reliability.

2.5 Payments (when enabled)

Paid subscriptions will be processed by our payment / Merchant of Record provider. They process billing details under their own privacy policy. We receive subscription status needed to enable Pro features, not your full card number.

3. How we use information

• Provide, maintain, and improve the Service
• Authenticate users and authorize Pro features
• Sync encrypted data across your devices at your request
• Provide customer support
• Detect abuse, secure systems, and meet legal obligations

4. Legal bases (EEA/UK)

Where applicable, we rely on:

• Contract — to provide the Service you request
• Legitimate interests — security, product improvement, support
• Legal obligation — when required by law
• Consent — where required (for example certain cookies or marketing)

5. Sharing

We do not sell personal information. We share data only with:

• Infrastructure providers (hosting, auth, CDN) that process data on our instructions
• Payment processors / MoR for subscriptions
• Authorities when legally required

6. Retention

• Local data: controlled by you; deleted when you clear extension data or uninstall (subject to browser behavior)
• Encrypted sync data: retained while your account remains active and Pro sync is used; deleted or made inaccessible when you delete account data through supported flows
• Support emails: retained as needed to resolve requests and maintain records

7. Security

We use industry-standard safeguards including transport encryption (HTTPS/TLS), access controls on production systems, and client-side encryption for Pro note bodies. No method of transmission or storage is 100% secure. Protect your device, account password, encryption password, and recovery words.

8. International transfers

Service providers may process data in the United States and other countries. Where required, appropriate transfer mechanisms are used by those providers.

9. Your rights

Depending on your location, you may have rights to access, correct, delete, or export personal data, or to object to / restrict certain processing. Contactsupport@bestnote.app. You may also lodge a complaint with your local data protection authority.

10. Children

Best Note is not directed to children under 13 (or the minimum age in your jurisdiction). We do not knowingly collect their data.

11. Browser permissions

The extension requests permissions needed to capture page content you choose, store data locally, show UI (popup/side panel), and — for Pro — communicate with our API and authentication services. Capture runs when you invoke it; we do not sell browsing history.

12. Changes

We may update this policy. Material changes will be posted on this page with an updated date. Continued use after changes means you accept the updated policy.

13. Contact

Questions about privacy:
Email: support@bestnote.app
Website: https://bestnote.app