Privacy · updated May 14, 2026

Local-First, By Design.

SideNotes is built around a single rule: your notes never leave your device unless you move them yourself. There is no cloud, no account, no telemetry, and no ad network. This page spells out exactly what that means in practice.

The short version

The SideNotes desktop app collects nothing about you, transmits nothing about you, and stores nothing about you on any server we run. We do not run any servers.

This marketing website uses Vercel's privacy-respecting Analytics for anonymous visit counts. That is the entire outbound-data footprint of the project.

The desktop app does not
  • Send telemetry, analytics, or usage data.

    There is no first-party or third-party tracking inside the desktop app. No crash reporters, no session replays, no SDKs.

  • Require an account.

    You install SideNotes, pick a folder, and start writing. There is no sign-up, no login, no server to authenticate against.

  • Make outbound network calls.

    Fonts and assets are bundled into the binary. The Electron auto-updater is disabled. The Content Security Policy permits zero remote origins.

  • Touch files outside your vault.

    SideNotes reads and writes only inside the folder you explicitly pick as your vault. Permissions are scoped to that folder.

What the app keeps on your device
  • Your notes, on your disk.

    Every note is a plain .md file in the vault folder you chose. Canvases save as .canvas JSON. Attachments stay where you put them.

  • A small index file.

    Alongside your vault, SideNotes maintains a tiny JSON index for fast search and graph links. It is safe to delete at any time.

  • App preferences locally.

    Theme, recent vaults, pinned items, and similar choices live in the operating system's standard application-support directory for SideNotes.

What this website (sidenotes.me) does
  • Vercel Analytics.

    This marketing site (sidenotes.me) records anonymous, aggregate visit counts and country-level geography for pages you load. No cookies, no fingerprinting, no personal identifiers. Vercel Analytics is GDPR / CCPA compliant by design and the data is not shared.

  • No remarketing pixels, no third-party trackers.

    There is no Google Analytics, no Meta pixel, no Hotjar, no Mixpanel, no Segment. Just the static pages you are looking at.

Your rights

Because the desktop app collects nothing, there is no data of yours to access, export, or delete on our side. Your vault is already in your possession; deleting the folder deletes the data.

For the anonymous analytics on this website, we do not collect identifiable information in the first place, so there is no individual record to look up. If you would prefer not to count at all, any standard tracker-blocker (uBlock Origin, etc.) blocks Vercel Analytics, and the site continues to work normally.

Children

SideNotes does not knowingly collect any information from anyone, including children under 13. The app is rated 4+ / Everyone in the Mac App Store and Microsoft Store.

Changes to this policy

If this policy ever changes, the new version will replace this page with an updated “updated” date at the top. There is no email list — release notes on the changelog page are the canonical heads-up.

Contact

Privacy questions, security reports, or anything else → hello@sidenotes.me.

SideNotes · MIT licensed · v0.2.0