Privacy Notice
Pass Note does not require an account and is designed to retain as little information as practical for as little time as practical.
Note content
The service receives your note over HTTPS and encrypts it before storing it in Amazon DynamoDB. The stored record contains ciphertext, a random identifier, and an expiration. Its unique decryption key is carried in the share token and is not retained as a separate server-side record.
A retrieval atomically removes the stored record before the plaintext is returned. If a note is not opened, the service refuses to return it after its selected expiration and DynamoDB subsequently removes the expired record through background time-to-live processing.
Share links
New share tokens are placed in the URL fragment after #.
Browsers do not include fragments in the initial request for a web
page; Pass Note's JavaScript submits the token in a POST body only when
a normal browser opens the link. Anyone with the complete URL can use
it, so treat it as sensitive until the note is consumed or expires.
Operational metadata and logs
The hosting and delivery infrastructure processes ordinary request metadata such as time, IP address, user agent, requested path, and response status. The application emits operational events for creation, retrieval, errors, and health checks. When a share token needs a traceable identifier, the application logs its SHA-256 fingerprint rather than the raw token. Note content is not written to application logs.
Accounts, advertising, and analytics
Pass Note requires no account and currently loads no advertising or analytics scripts. The site itself does not use cookies or browser storage to identify returning visitors. Page styling requests an Orbitron stylesheet from Google Fonts, so Google receives ordinary request metadata for that resource under its own privacy terms.
If you contact Pass Note by email, the message and address may be retained for support, security, and operational follow-up. Do not put a real secret or an active share URL in an email to us.
Service providers and disclosure
Amazon Web Services hosts the application and processes data needed to deliver and protect it. Information may also be preserved or disclosed when required by law or necessary to investigate abuse, protect the service, or protect users.
Questions
Privacy questions can be sent to jimmy@passnote.io.