This policy covers the Jorlyn Notes website at jorlyn.online and the Jorlyn Notes Android app, which displays that same website. They are one service and are treated as one throughout this document.
When you sign up, an email address, a username and a password are stored. The password is never stored as you typed it — only a one-way hash of it is kept, which cannot be reversed back into your password.
Notes, to-dos, tags, links between notes, calendar events, pets, and any files you upload are stored so the app can show them back to you. This content is private to your account. It is not read, mined, sold, or used to train any model.
Two features can make specific content reachable by other people, and only when you choose to use them: sharing a note creates a secret link that anyone holding it can open, and subscribing to your calendar creates a secret feed address. Both stay private unless you hand the link out, and both can be revoked.
Each request to the site records the IP address, the page requested, the browser user agent string, and the time. This is used to keep the service running, understand rough traffic levels, and identify abuse. It is not linked to your notes.
Both are strictly necessary for the app to work. Neither is used for advertising or tracking you across other sites.
Jorlyn Notes uses a small number of outside services. Each has its own privacy policy governing what it does with what it receives.
Beyond these, your information is not sold, rented, or handed to anyone. The only other case where it would be disclosed is if the law required it.
Google and its partners may use cookies to serve ads based on your previous visits to this or other websites. You can turn off personalised advertising in Google's Ads Settings, or opt out of third-party vendors' use of cookies at aboutads.info.
Ads appear on the public pages. They are not placed inside your notes.
The whole site is served over HTTPS. Passwords are stored only as hashes. Sign-in cookies are marked HttpOnly, so page scripts cannot read them, and requests that change your data are checked against a token to block cross-site forgery.
No system is perfectly secure, and it would be dishonest to claim otherwise. Jorlyn Notes is a small independent project — please keep your own backups of anything you cannot afford to lose. Exports exist for exactly this reason.
Content you delete is removed from the live database. Backups may hold a copy for a short period before they roll over.
Depending on where you live, you may have additional rights over your personal data — such as under the GDPR in the EU/UK or the CCPA in California — including the right to access it, correct it, or demand its deletion. The contact address below is how to exercise any of them.
Jorlyn Notes is not directed at children under 13, and accounts are not knowingly created for them. If you believe a child has made an account, write to the address below and it will be removed.
If this policy changes, the date at the top of the page changes with it. Material changes will be announced in the app rather than made quietly.
Questions about this policy, requests to see your data, or requests to delete your account: support@jorlyn.online.