JotDrop Cloud

Privacy policy

Last updated: October 28, 2026

JotDrop Cloud keeps your JotDrop notes in sync between your devices. This policy covers JotDrop Cloud: this website and the cloud features in the JotDrop plugin for Obsidian and the JotDrop Android app. Using JotDrop without the cloud never needs an account; the Android app policy covers the app itself.

JotDrop is made by Diexar, República Argentina 1 Bajo 7, 03160 Almoradí (Alicante), Spain, which is responsible for your data. Questions or requests: hello@jotdrop.net.

What we cannot see

Your notes and attachments are encrypted on your device (AES-256-GCM) before they leave it, and file names are replaced by random-looking IDs. Your password never leaves your device. The key that opens your notes stays on your devices and in your recovery code, so neither our server nor we, nor any service named below, can read your notes.

What we store

• Your email address.
• What we need to check your sign-in, none of which reveals your password: a salt and key settings, a hash of a login key that your device derives from your password, your note key locked with your password, and, if you turn it on, your authenticator secret encrypted with a server key.
• If you continue with Google or GitHub: the fixed account ID they give us and your verified email address. Not your name, photo, contacts or repositories.
• Your devices: the name you give each one, when it was added and when it last connected.
• Your encrypted notes and their earlier versions, with their size, the time they were saved and which of your devices saved them.
• Your plan: free or JotDrop Plus, whether you used the trial, and for a subscription the Stripe subscription ID, its status and the date it is paid until.
• If you tick "Email me news about JotDrop.": when you ticked it and when we added you to our mailing list.
• For one day after an account is made: a keyed hash of the network (IP) address it was made from, so that one network cannot open many accounts. It is deleted after that day.
• Short-lived codes, only as keyed hashes. Email codes expire after 15 minutes and Google or GitHub sign-in links after 10 minutes. We count wrong codes per account or email address to stop guessing.

What we do not collect

Your IP address is used in memory to limit repeated attempts; apart from the one-day hash above, it is not written to our database or to logs. JotDrop Cloud has no ads, no analytics and no tracking cookies, and this website loads nothing from other sites, except Cloudflare's person check on the form for a new account. The website keeps you signed in only if you choose "Stay signed in on this browser", and then stores that in your browser.

Services that process data for us

• Our hosting provider runs our server in Germany. It stores the data above, encrypted notes included.
• Amazon Web Services (Amazon SES, Frankfurt) sends our emails: sign-in and confirmation codes and security notices. It receives your email address and the message.
• Brevo (France) sends JotDrop news and welcome emails, only if you ticked "Email me news about JotDrop.". It receives your email address. Every email has an unsubscribe link.
• Stripe handles JotDrop Plus. When you buy Plus we send Stripe your email address and an internal ID of your cloud. Stripe, through Link, sells the subscription to you as the merchant of record and handles your payment details and taxes under its own privacy policy. We never see your card details; we only receive the subscription status.
• Google and GitHub, only if you choose "Continue with Google" or "Continue with GitHub". They confirm who you are and learn that you signed in to JotDrop Cloud, under their own privacy policies.
• Cloudflare forwards email you send to hello@jotdrop.net to our mailbox. When you create an account with an email address, Cloudflare Turnstile checks that a person, not a script, does it; for that check Cloudflare sees your IP address and details about your browser.

We do not sell your data or share it with anyone else, unless the law requires it.

Why we may use it

• To provide JotDrop Cloud to you (your account, sync, codes and JotDrop Plus): this is needed for our agreement with you.
• To send news: your consent, which you can withdraw at any time with the unsubscribe link or by emailing us.
• To keep the service safe, for example limiting repeated attempts: our legitimate interest in preventing abuse.
• To keep payment records: legal obligations, handled by Stripe as the seller.

Transfers outside the EU

Our server runs in Germany, Amazon SES in Frankfurt, and Brevo is based in France. Stripe, Google, GitHub and Cloudflare may process data outside the EU, such as in the United States, under the EU Standard Contractual Clauses or the EU-US Data Privacy Framework.

How long we keep it

• Your account, devices and encrypted notes: until you delete your account. Earlier versions and deleted notes stay in your cloud, encrypted. When a free cloud is full, the oldest versions and deleted notes that only JotDrop Plus can open are removed first; the current version of a note always stays.
• A sign-up that is not confirmed is removed after 15 minutes.
• Your place on the mailing list: until you unsubscribe.
• When you delete your account, your cloud, account, devices and linked Google or GitHub sign-in are deleted at once, a running JotDrop Plus subscription is cancelled and your address is removed from our mailing list. Any backup copies hold the same encrypted data and are replaced over time.

Your rights

You can delete your account yourself at any time: "Delete account" in Devices & recovery on this website, in the JotDrop Cloud settings in Obsidian, or in the JotDrop Cloud screen of the Android app. You can also ask us for a copy of your data, to correct it, to delete it, to limit or object to its use, or to receive it in a portable form. Your notes are already yours as Markdown files on your own devices. Email hello@jotdrop.net from the address of your account. You can also complain to a data protection authority, such as the Spanish AEPD or the one where you live.

Children

JotDrop Cloud is not intended for children under 14.

Changes

We update this policy when JotDrop Cloud changes and change the date at the top. For important changes we tell you by email.

Back to JotDrop Cloud