Legal & Privacy

What Notilock does

Notilock encrypts text content in your browser using AES-256 encryption before storing it in your Notion workspace. Your master password never leaves your device — we cannot read, access, or recover your encrypted content.

Data we collect

• Account info: Your Notion account identity, used only for authentication via Notion OAuth. We do not store passwords.
• License status: Whether you have an active license, linked to your user ID. Stored securely in our database.
• Payment info: Processed entirely by Polar.sh. We never see or store your card details.
• Anonymous analytics: Page views via Plausible Analytics — no cookies, no personal data, no tracking across sites.

Data we do NOT collect

• Your master password — it only exists in your browser's memory while the app is open.
• Your note content — we only handle encrypted ciphertext that is unreadable without your password.
• Your Notion data — our worker proxies encrypted content to Notion but never reads or stores plaintext.
• Cookies or tracking identifiers — we use Plausible, which is cookieless.

Where your data lives

Your encrypted notes are stored in your own Notion workspace — not on our servers. If Notilock shuts down, your ciphertext stays in Notion. With your master password and any standard AES-256 decryption tool, you can recover your content independently.

Payments & refunds

Notilock offers a one-time lifetime payment processed by Polar.sh. Since the product offers a free trial before purchase, refunds are handled on a case-by-case basis. Contact me directly if you have any issues.

Third-party services

• Cloudflare Workers — API proxy between your browser and Notion.
• Notion API — Stores your encrypted content in your own workspace.
• Polar.sh — Payment processing.
• Plausible Analytics — Privacy-first, cookieless analytics.

Contact

Notilock is built and maintained by David Maillo. For any questions, concerns, or refund requests, reach out on Twitter/X or via email at david@notilock.com.