Sidenote privacy policy

Last updated 6 September 2026

Sidenote is a notepad that runs in Chrome's side panel. It keeps your notes on your own computer. This policy describes what it stores, the one case where anything leaves your machine, and what it never does.

What Sidenote stores, and where

Your notes, boards, and settings are saved in Chrome's local extension storage. Images you paste or save are stored in IndexedDB in the same browser profile. Both live on your computer. Sidenote does not upload them, back them up to any server, or read them anywhere else.

If you connect Sidenote to a folder, it also writes your notes there as Markdown files with an attachments folder beside them, so you can open them in Obsidian or any text editor. You choose that folder yourself through Chrome's folder picker, and Sidenote can only write inside it. Those files are yours and Sidenote never deletes a note file you have kept.

Sharing a note

Sidenote can turn one note into a read-only link. This is the only feature that sends anything off your computer, and it only runs when you ask for it.

When you publish a note, Sidenote encrypts it in the browser using AES-GCM with a 256-bit key generated on your machine. Only the encrypted result is uploaded. It is stored by a Cloudflare Worker and object store operated by Sidenote's developer.

The decryption key is put in the part of the link after the # character. Browsers never send that part of a URL to a server, so the key stays between you and whoever you give the link to. The server holds ciphertext it cannot read.

In practice this means the operator of the server can see that a note was published, how large it is, and when it was fetched. The operator cannot read its title, its text, or its images.

Anyone who has the full link can read that note, so treat a share link as the secret it is. Deleting the share removes the encrypted note from both the database and the object store, and the link stops working immediately.

Site access

Sidenote does not ask for access to the sites you visit when you install it.

If you save an image or a link from a site that does not allow other pages to read its files, Chrome will ask whether you want to grant access. You can say no and Sidenote keeps working, since most sites do not need it. You can withdraw the permission later from chrome://extensions. Sidenote uses that access only to fetch the image or the page title and preview picture you asked it to save.

What Sidenote does not do

No analytics and no telemetry. Sidenote has no code that reports how you use it.
No accounts, no sign-in, and no password.
No advertising, and no data sold or shared with anyone.
No third-party services and no external code. The extension loads nothing from any other server.
No tracking across sites, and no reading of pages you have not asked it to read.

Keeping and deleting your data

Notes stay on your computer until you delete them. Deleting a note in Sidenote removes it and its images from the extension's storage. Removing the extension from Chrome deletes everything it held. Markdown files Sidenote has written into a folder you chose are yours and stay where they are, for you to keep or delete yourself.

A published note is stored until you delete the share or its expiry date passes. Deleting a share removes the encrypted note immediately, and the link stops working. Nothing is kept as a backup copy.

Limited Use

Sidenote's handling of user data follows the Chrome Web Store User Data Policy, including its Limited Use requirements. Data is used only for the feature you asked for, is never sold or passed to data brokers, is never used for advertising or credit decisions, and is never read by a person.

Changes

If this policy changes, the date at the top changes with it. A change that affects what leaves your computer will be described here rather than quietly edited in.

Contact

Questions about this policy, or a request to remove a published note, can go to ayodejiareago111@gmail.com.