Notefoot

Privacy Policy — Notefoot

Effective November 2026

This policy describes what Notefoot collects, why, where it is stored, and the choices you have. It is written in plain language on purpose. If anything here is unclear, ask us at hello@notefoot.com.

The short version

We do not sell personal data, and we have no data-broker relationships.
Notefoot shows ads: businesses can promote a place or a note inside the app, and the app also shows ads from Google AdMob. Section 7 explains what that involves.
Your account is a username and a password. We never ask for your email to run your account.
Your location is used because the app is about places; the details are in section 4.
You can delete your account and your content, as described in section 9.

1. What we collect

Account data

Your username, a display name and profile details you choose to add (such as a bio, profile photo, banner, location text, and links you add to your profile).
Your date of birth, which we ask for at sign-up only to check that you are at least 13. It is never shown on your profile or shared with other users.
Your password, stored as a salted password hash. We never store your password in plain text and cannot read it.
Your optional 12-word recovery phrase, stored only as a salted cryptographic hash. We cannot read it, reconstruct it, or use it to open your account ourselves.

Content you create

Voice notes, photos, clips, captions, automatic captions generated on your device, comments, likes, saves, and your place information attached to posts (the place name and coordinates of a dropped note).
Direct messages and group messages, and call signalling data needed to connect calls (who called whom, and when a call started and ended). Call audio and video are not recorded or stored by us.
Stories, channel memberships, follows, blocks, and reports you make.

Device and usage data

Basic technical data needed to run and secure the service: your IP address, device and app version information sent by your device, session tokens, timestamps, and server logs of requests.
If you enable push notifications, a push token issued by the notification provider so notifications can reach your device (see section 6).
If you download an area of the map for offline use, the notes in that area are stored on your device. That happens on your device; we only see the request.

What we do not collect

We do not require or collect an email address, real name, phone number, or government ID to use Notefoot.
We do not run third-party analytics trackers in the app. The one third-party service that collects data for its own purposes is Google AdMob, described in section 7.

2. How we use it

We use the data above only to:

Operate the service: create and secure accounts, show feeds and profiles, deliver posts to the audience you chose, deliver messages, connect calls, and unlock sealed notes when your device is near the drop point.
Keep the service safe: enforce the Terms of Service, review reports, prevent spam, ban evasion, and abuse of the infrastructure.
Fix problems and understand reliability: server logs and error data used to debug and to protect the service.
Communicate with you inside the service (for example, account and safety notices). We have no email list for your account because we do not collect your email.

We do not build advertising profiles from your content or your location, and we do not sell or rent personal data to anyone. Promotions on Notefoot are aimed by the place and the area the advertiser picks, never by who you are.

3. Where it is stored and who processes it

Notefoot runs on Cloudflare infrastructure (Workers, D1 database, R2 storage, and Durable Objects for real-time messaging). Your data is stored and processed on Cloudflare's network, which may place data in more than one country. Map tiles and place data come from OpenStreetMap-based services; when the app loads a map, the map provider sees the map area requested and your IP address, as with any map service.

Call media is carried over WebRTC. When a direct peer connection is not possible, media passes through TURN relay servers in encrypted form; relays cannot read it and do not store it.

4. Location — the important part

Location is central to Notefoot, so be clear about how it works:

Dropped notes. When you post a note as "dropped here", the post stores the place and the coordinates where you dropped it. That location is part of the post and is shown to the post's audience. Anyone in the audience can see where a dropped note is.
Sealed notes. A sealed note stores its drop coordinates so the app can check distance. When you view a sealed note, your device compares its own position with the drop point. Unlocking happens on your device; the check does not require us to keep a history of where you have been.
Feeds and map. "Near you" feeds, the map, and area downloads send your approximate position or a map area to the server so it can return nearby notes. We do not build a movement history or a location trail of your account, and we do not sell location data.
Your control. You can deny the app location permission at the device level. Without it, dropped-here posting, near-you feeds, and sealed unlocking will not work; the rest of the app will. A post's saved location stays with that post until the post is deleted.

Do not drop a note at a place that reveals something private about you or someone else (for example, exactly where a person lives) unless everyone involved understands it will be visible to the post's audience.

5. Who can see what

Public posts are visible to anyone who can access Notefoot, including people without accounts where the service allows it, and may be indexed or copied by viewers. Private and named-people posts are restricted on our systems to the audience you chose, but any viewer can save or reshare what they can see. We cannot control copies made outside Notefoot.
Messages are visible to the participants in the conversation. Participants can save or share them outside the app; we cannot prevent that.
Profile information you add (display name, bio, photo, banner, location text, links) is public to other users.
We may disclose data when required by law, court order, or a valid legal process, or where we reasonably believe disclosure is necessary to prevent serious harm. Where the law allows it, we will tell the affected user.

6. Notifications

If you enable notifications, delivery may be handled by third-party push providers (such as Firebase Cloud Messaging on Android, once enabled). The provider receives a device push token and the notification payload needed to deliver it. Notification content in payloads is kept minimal where the platform allows it. You can turn notifications off in the app's settings or at the device level at any time.

7. Advertising and payments

Notefoot carries two kinds of advertising, and both are labeled in the app.

Promoted places and notes. A business can pay to promote a place or a note so it appears in feeds and around its place, labeled "Sponsored" or "Promoted". We count views, plays, saves, and direction taps for the promotion on our own servers, so the business can see how its promotion did. Those counts are totals about the promotion. They do not identify you, and we do not give the business your personal data.
Google AdMob. The app also shows ads served by Google AdMob, labeled "Sponsored". AdMob may collect and use your device's advertising ID, approximate location, and device information to serve and measure ads, as described in Google's own privacy policy. You can reset or delete your advertising ID and turn off ad personalization in your device settings. Where the law requires it, the app asks for your consent before personalized ads are served.

If you buy a promotion, payment is processed by Stripe. Stripe receives your payment details; we never see or store your card number. We keep a record of the payment itself (the amount, the dates the promotion ran, and any refund) so your promotion and its results page stay accurate.

8. Cookies and the website

notefoot.com serves these legal pages and basic site functions. The website does not set advertising cookies. Advertising inside the app works as described in section 7.

9. Your rights: access, correction, deletion

You can see and edit most of your data in the app (profile, posts, messages you sent).
Deleting content. Deleting a post removes it from the service and from other users' views. Deleted content may remain in backups for a limited period (normally up to 30 days) before being overwritten, and copies other users made outside the service are outside our control. Messages you sent remain visible to the other participants after you delete your copy, unless the app offers conversation deletion for all participants.
Deleting your account. Deleting your account removes your profile and your posts, and ends your sessions. Some records may be retained where the law requires it or to enforce bans and prevent abuse (for example, a record that an account was terminated for child-safety violations). Retained records are kept only as long as needed for that purpose.
Depending on where you live, you may have legal rights to access, correct, export, or delete your personal data, and to object to some processing. Write to hello@notefoot.com and we will respond as the applicable law requires. Because accounts are username-only, we may need you to prove control of the account (for example, by signing in) before acting on a request.

10. How long we keep data

Account and content data: while your account exists, plus backup retention as described above.
Server and security logs: normally up to 90 days, longer where needed for an active investigation or legal obligation.
Reports and moderation records: as long as needed to enforce the Terms of Service and comply with the law.

11. Children

Notefoot is not directed at children under 13, and you must be at least 13 to use it. If we learn an account belongs to a child under 13, we will delete the account and its data. If you believe a child under 13 is using Notefoot, write to hello@notefoot.com.

12. Security

Passwords and recovery phrases are stored as salted hashes. Data is encrypted in transit. Sessions can be revoked (for example, a password reset revokes your other sessions). No system is perfectly secure; if we become aware of a breach affecting your data, we will act as the applicable law requires. Keep your password and recovery phrase safe: anyone with them controls your account, and the recovery phrase cannot be reset by us if you lose it.

13. Changes to this policy

We may update this policy. The current version will be posted at notefoot.com/privacy with its effective date, and material changes will be surfaced in the app.

14. Contact

hello@notefoot.com

Liability & Safety: notefoot.com/liability