Privacy

Jotzen privacy policy

In short

• Your notes are ordinary files in folders you choose, on your own devices.
• Without an account, Jotzen sends nothing anywhere.
• Sync and sharing are optional. Notes are encrypted on your device before they leave it, and the service stores only text it cannot read.
• No analytics, telemetry, crash reporting or advertising.

Who we are

Jotzen is made by Focalward. [To be supplied: the publisher (data controller) and contact details for privacy requests]

On your devices

• Notes and files stay in the folders you choose, as ordinary files. Linked folders (such as a code repository) are read and edited in place and never synced.
• Jotzen’s own data on your computer: settings; an index of your notes for searching (in your computer’s cache folder); local history of notes (up to 50 versions per note, in the vault’s .jotzen folder); text read from PDFs and images (cache); and, if sync is on, the sync state and keys, kept in your system’s protected storage.
• Done on your device: text recognition in scanned PDFs and in images, search, diagrams and math. The web clipper talks only to Jotzen on the same computer.
• Encrypted text you lock in a note stays in the note as ciphertext. Its password is never stored or sent.
• The desktop app has no analytics, telemetry, crash reporting or advertising, makes no automatic update checks, and its window cannot open network connections.
• The phone app (in progress) keeps a copy of your synced vault only while you are signed in. Recognizing text in photos on the phone uses Google’s ML Kit, which runs on the phone; Google’s documentation says it may contact Google, for example for model updates and usage metrics. [To be supplied: confirmation of ML Kit’s data use]

On the sync service (only with an account)

• End-to-end encrypted: note text, names and paths, attachments and history are encrypted on your device before they are sent. Keys come from your master password, which never leaves your device.
• What the service can see: your account’s email address and ID, public keys, how many notes and attachments there are and their sizes, when they change, and which accounts share which notes and with what role. It cannot see what your notes say or what they are called.
• Sign-in uses Amazon Cognito, which stores a login secret derived on your device from your master password (not the password itself) and sends the sign-up confirmation email. There is no password recovery: a reset could not decrypt your notes.
• Sharing a note lets the other person’s account read it. Looking someone up by email tells you whether that email has a Jotzen account.
• Logs record the kind of request and the name of an error, never requests, tokens or note data, and are kept for one month.

Where it is stored

The sync service and sign-in run on Amazon Web Services in the United States (region us-east-1), in accounts Focalward controls. [To be supplied: any other processors, such as a website host, support or payment provider]

How long, and deleting it

• Deleting a note removes its text, history and attachments from the service at once. For a shared note, its encrypted name stays until every member’s device has removed its copy (a year at most); then only its ID remains, until a year after deletion.
• Deleting your account (in the app) deletes everything it owns on the service, its memberships and its sign-in. Your own files stay on your devices.
• Change history: 30 days. Removal notices: 90 days. Unused uploads: 1 day. Backups of the service’s encrypted data: 35 days for the database, 30 days for stored files.
• Your data: the readable copy is the files on your devices; the app can also export the vault as a .zip.

Still to be supplied

• [To be supplied: legal bases and the regions this policy addresses, after legal review]
• [To be supplied: age requirements]
• [To be supplied: whether Jotzen will be paid, and the payment provider]
• [To be supplied: how changes to this policy will be announced]