Last updated: September 9, 2026
NoteStash ("the app") is a desktop app from EERIE for keeping notes on boards and columns. Everything you create is kept on your own device. If you choose to create an account, the text of your notes is also kept on a server we run, so your other devices show the same boards.
Nothing at all unless you create an account. Without an account the app never contacts us and we hold no data about you. If you do create one, we hold your email address, a scrambled form of your password, and a copy of the text of your boards. There is no analytics, no telemetry and no tracking in either case.
Your boards, columns, notes, labels, images, attached PDFs and app settings are stored on your device, in the app's own storage folder. Settings shows how much room they take up.
An account is optional. It exists so that signing in on another computer brings your boards with you. To create one you give an email address and pick a password.
Your password never leaves your device. The app scrambles it on your own machine first, and only the scrambled result is sent to us. What we keep is a further scrambled form of that, so the password itself cannot be worked out from anything we hold, by us or by anyone who obtained a copy of our records.
We keep your email address, that scrambled password, the date the account was made, whether the address has been confirmed, and an internal reference that ties the account to your saved data. We do not keep your name, your device details, your location, or your IP address.
We send email only to confirm your address when you sign up or ask for a new confirmation code, and to send a code if you ask to reset your password. All of them are six digit codes that stop working after fifteen minutes. We do not send newsletters, marketing or any other mail. These messages are sent through Resend, an email delivery service, which handles your address under its own privacy policy in order to deliver them.
When you are signed in, the app keeps a copy of the text of your boards on a server we run on Cloudflare, and stores the time it was last saved. That copy is encrypted before it is written, with a key held only by our service and never stored alongside the data, so the stored records are unreadable on their own. Your email address is not encrypted, because it has to be looked up when you sign in.
Only text is sent: titles, note details, labels and the layout of your boards. Images and PDFs are never uploaded. They stay on the device you added them on, and a note opened on another device shows its text without them.
Signing out on a device stops that device syncing and leaves your other devices working. It does not delete the copy on the server. Delete account, in Settings, removes the account and everything stored with it from the server after you confirm your password; your boards on your own device are not affected.
When you paste an image or a PDF into a note, the app reads it from your clipboard at that moment and saves it in its own storage folder. It never reads your clipboard at any other time. Images can be compressed to take up less room; this happens on your device. Opening an attached PDF hands the file to whichever app your computer uses for PDFs. Extracting a PDF's text into a note happens on your device.
Export writes a backup file to a location you choose, and Import reads a backup file you select. These files stay on your device and under your control. The app never uploads them. If two devices edit the same board while apart, the copy that was replaced is kept in the app's storage folder rather than discarded.
With no account signed in, the app does not send your data anywhere. It fetches its typefaces from Google Fonts when it starts, which means Google receives the ordinary connection details of that request under its own privacy policy; nothing about you or your notes is included. Other connections are opened only when you sign up or sign in, while you are signed in and your boards are being kept in step, or when you choose to click a link, such as the footer links, which opens that page in your default browser under that site's own privacy policy.
The app does not collect analytics, telemetry, usage data, or device information. The processor and memory figures it can show in its footer are read on your device and never sent anywhere. It does not use advertising SDKs. We do not sell or share your data with anyone, and we do not use it to build a profile of you.
You can delete your account yourself from Settings at any time. You can also ask us for a copy of what we hold about your account, ask us to correct it, or ask us to delete it, by emailing the address below. Deleting the account removes the email address, the scrambled password and the stored copy of your boards. The copy on your own device is yours and is not affected.
NoteStash is not aimed at children and we do not knowingly collect personal information from them.
If the app is obtained through the Microsoft Store or another platform, the respective platform may process data related to download, purchase, and licensing under their own policies. This policy describes only processing performed by the NoteStash app itself.
If this policy changes, the updated version will be posted at this URL with a new "Last updated" date.