Privacy Policy

Effective date: August 10, 2026
Last updated: August 10, 2026

TreeNote is an offline-first hierarchical notebook app for Android. This policy explains what data the app handles, when, and why. Read Terms of Service for the terms governing your use of the service.

TreeNote is developed and operated by Ed Lord, an individual developer, based in the United States. Contact information is at the bottom of this policy.

Summary — the short version

If you use TreeNote without signing in for cloud sync, the app collects no data at all. Everything lives on your device.

If you sign in to enable cloud sync, the app stores your email address and the contents of your notebook on a managed database (US region) so you can access them from any device where you’re signed in. You can delete your account and all associated cloud data at any time from within the app.

The full details of every data type, storage location, and processing purpose follow below.

1. What the app collects, and when

1.1 Local-only mode (default)

If you never sign in to cloud sync, TreeNote collects, transmits, or stores no data anywhere off your device. Every note, task, and setting is written to a local database on your device and never leaves it. There is no telemetry, no crash reporting, no analytics, no advertising SDK, and no third-party tracker of any kind in the free local-only mode.

Uninstalling the app deletes all local data.

1.2 Cloud sync mode (opt-in)

When you sign in to TreeNote Cloud (Settings → Sync → Create account or Sign in), the app begins storing the following on our managed database at Supabase (US East region):

• Account credentials
  • Your email address
  • A cryptographic hash of your password (never the plaintext)
  • The date and time of your account creation and most recent sign-in
• Your notebook content
  • The title, body text, and rich-formatting data of every note you create
  • The tree structure (which notes are children of which)
  • Task metadata: whether a note is a task, its completion state, its due date if any
  • Timestamps: creation and last-modified time for every note
• Sync metadata
  • Per-row revision numbers used to coordinate multi-device sync
  • Deletion markers (tombstones) for notes you’ve deleted, retained until they’ve been propagated to all your devices
• Subscription state
  • Whether your account is on the free, comp’d, trial, active, grace period, or expired tier
  • The expiration timestamp of your current subscription period
  • The identifier of your active subscription plan

1.3 Payment processing

If you subscribe to TreeNote Cloud (or start a free trial that will convert to a paid subscription), the payment itself is processed entirely by Google Play Billing. TreeNote never sees, receives, or stores your payment card details or billing address — those are handled inside Google Play and governed by Google’s own privacy policy.

RevenueCat, Inc. processes the events Google Play emits (initial purchase, renewal, cancellation, expiration, billing issues) and notifies our systems so we can update your entitlement state. RevenueCat sees a randomly-generated identifier for your account (the same one Supabase uses) plus the subscription lifecycle events — it does not see the contents of your notes, your email address, or your payment method.

1.4 What we do NOT collect

For clarity, the following categories of data are not collected in either mode:

• Location data of any kind
• Device identifiers (advertising ID, IMEI, MAC address)
• Contact lists or address book access
• Photos, media, or other files outside the app’s own local database
• Microphone or camera data
• Browsing history
• Health or fitness data
• Financial account information

2. Why the app collects it (purpose and legal basis)

2.1 Purpose

• Your email and password hash exist solely so you can sign back in from another device.
• Your notebook content exists on the server solely so it can be delivered to your other devices when you sign in.
• Subscription state exists so the app knows whether to enable cloud sync features for your account.

We do not use any of this data for advertising, profiling, sale to third parties, machine-learning training, or any purpose beyond providing the sync service you signed up for.

2.2 Legal basis (GDPR, for users in the EEA / UK)

• Contract performance — processing your notes and subscription data is necessary to provide the cloud sync service you have contracted for by subscribing.
• Legitimate interest — limited processing of account metadata (sign-in times, sync activity) for security purposes (detecting abuse, protecting the service).
• Legal obligation — retention of subscription and financial records where required by tax or accounting law.

We do not process any personal data on the basis of consent for advertising or profiling. There is no such processing.

3. Who has access to your data (subprocessors)

We use the following third-party services to operate the sync feature. These are our “subprocessors” — they process data on our behalf, under contract, and are not permitted to use it for their own purposes.

We do not share, sell, rent, or trade your data with any other third party. If we ever add a new subprocessor (for example, error reporting or analytics — currently we have neither), this policy will be updated and existing users will be notified before the new processing begins.

4. Data retention

• Notebook content and account data are retained for as long as your account exists.
• When you delete your account (Settings → Sync → Delete account in the app), we immediately delete all your notebook content, your user profile, and your authentication record. Any backup snapshots we maintain are purged within 30 days.
• Subscription and payment records are retained by Google Play and RevenueCat according to their own retention policies, which are governed by tax and accounting requirements. We do not independently store payment information.
• Sync tombstones (markers for deleted notes) are retained as long as your account exists so we can propagate deletions to all of your signed-in devices. Tombstones are removed when you delete your account, along with the rest of your data.

5. Your rights

Depending on where you live, you may have rights over the personal data we hold about you. Regardless of jurisdiction, TreeNote lets you exercise the most important of these directly in the app:

• Access / portability — Export your entire tree as a human-readable JSON file (Settings → Export all data). This includes every note, structure, and timestamp we hold for you.
• Deletion (right to erasure) — Delete your entire cloud account and all associated data in one action (Settings → Sync → Delete account). Your local notes on the device are preserved unless you also uninstall the app.
• Correction — Edit any note directly in the app. Your changes sync to our database within seconds. If you need to correct account information (email address, etc.), contact us at the address below.
• Restriction / objection — Stop cloud sync at any time by signing out (Settings → Sync → Sign out). Your data remains on our servers under your account until you sign back in or delete the account. To object to further processing entirely, delete your account.

For any right that isn’t self-serve in the app (for example, a formal GDPR data-portability request in a specific format), email the contact address below. We aim to respond within 30 days.

California residents have additional rights under the CCPA/CPRA including the right to know what personal information we’ve collected, the right to delete it, and the right to opt out of the sale or sharing of personal information. TreeNote does not sell or share personal information for cross-context behavioral advertising, and never has. Contact us to exercise other CCPA rights.

Do Not Track — TreeNote does not track users across websites or apps. There is nothing for a DNT signal to disable.

6. Security

• All connections between the app and our servers use HTTPS with TLS 1.2 or higher.
• Passwords are hashed using industry-standard algorithms (bcrypt or equivalent) before being stored. We never store or have access to your plaintext password.
• Row-Level Security policies in the database enforce that only your authenticated account can read or write your notebook data — even our own administrative staff cannot query one user’s notes as another user.
• Data at rest on our subprocessor’s infrastructure is encrypted per their standard security controls (AES-256 in most cases).

No security system is perfect. If we discover a breach affecting your account data, we will notify you promptly and take corrective action.

7. Children’s privacy

TreeNote is not directed to children under 13 in the United States, or under 16 in the European Economic Area. We do not knowingly collect personal data from children in these age groups. If you believe a child has provided personal data to us, contact us and we will delete it.

8. International transfers

TreeNote’s servers are located in the United States. If you use TreeNote Cloud from outside the United States, your data will be transferred to, stored in, and processed in the United States. By using the cloud sync feature you consent to this transfer.

For users in the EEA or UK, we rely on the appropriate transfer mechanisms (currently the EU-US Data Privacy Framework and, where applicable, Standard Contractual Clauses) to ensure your data receives an adequate level of protection.

9. Changes to this policy

We may update this policy from time to time. When we do, we will update the “Last updated” date at the top. Material changes — for example, adding a new subprocessor or a new category of data collection — will additionally be notified to signed-in users by email or in-app notice at least 14 days before taking effect. Your continued use of the app after that notice period constitutes acceptance of the updated policy.

10. Contact

Questions about this policy, requests to exercise your rights, or any other privacy-related matter:

Email: support@treenoteapp.com

Postal mail:
Ed Lord
221 Pine Mill Rd
Clarksboro, NJ 08020-1511
United States